The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses and processes sensitive local application data by reading Claude session transcripts.
Evidence: The script scripts/okf_backfill_events.py resolves and reads JSONL files from ~/.claude/projects/.
Details: These transcripts contain previous user interactions and agent outcomes, which are subsequently sent to sub-agents (and thus external AI model providers) for analysis. While the skill claims to truncate text for privacy, the access to internal session history constitutes a data exposure risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from git commit messages and diffs which could contain malicious instructions designed to influence the behavior of the analysis agents.
Ingestion points: scripts/okf_backfill_events.py extracts subject, body, and diff content from git logs, as well as user and outcome text from session transcripts.
Boundary markers: Absent. The instructions do not specify the use of strict delimiters or system prompts that instruct the sub-agents to ignore instructions embedded within the history data.
Capability inventory: The skill has the capability to write files to the .okf/ directory, execute shell commands via subprocess, and spawn sub-agents using the agentType parameter.
Sanitization: The extraction script performs head+tail truncation of text fields to a maximum length (default 2000 chars), but does not sanitize content for executable-style prompts or instruction-bypassing text.
[COMMAND_EXECUTION]: The extraction script uses subprocess calls to execute git commands on the local filesystem.
Evidence: scripts/okf_backfill_events.py contains multiple subprocess.run calls to execute git log, git show, git diff, and git rev-parse.
Details: While the script uses list-based arguments rather than shell=True, it operates on user-supplied repository directories and branch names, which could be leveraged if path sanitization is bypassed.

backfill