The Agent Skills Directory

[PROMPT_INJECTION]: The instructions use forceful directives to override the agent's decision-making process, specifically stating "You MUST run ALL 8 dimensions" and "do not skip any," even when data is insufficient. Repeated "Do not skip it" markers are used to ensure the agent performs high-resource or invasive checks.
[DATA_EXFILTRATION]: The skill instructs the agent to read highly sensitive directories containing private user history and session transcripts: ~/.claude/projects/**/*.jsonl and ~/.codex/sessions/**/*.jsonl. Accessing these files exposes all previous interactions, including potentially sensitive data shared in past chats.
[COMMAND_EXECUTION]: The workflow relies on executing shell commands (bash) and running python3 scripts to scan the filesystem and analyze logs, which grants the skill broad system interaction capabilities.
[DYNAMIC_EXECUTION]: The skill directs the agent to "Use python3 scripts via Bash" to perform analysis but does not provide the script content. This implies the agent must generate and execute code at runtime to fulfill the request, which is a significant security risk if the generated logic is influenced by malicious data.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (session transcripts).
Ingestion points: Reads *.jsonl files from ~/.claude and ~/.codex directories.
Boundary markers: The instructions do not define any delimiters or warnings to treat the content of the transcripts as untrusted data.
Capability inventory: The skill has the capability to read files, execute shell commands, and run Python code.
Sanitization: There is no mention of sanitizing or escaping the content of the transcripts before they are processed by the analysis logic, potentially allowing instructions embedded in old logs to influence the agent's current behavior.

skill-optimizer