The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses the local directory ~/.claude/projects (or ~/.gemini/config/projects), which contains the user's full AI interaction history. This data is highly sensitive and may contain source code, private configuration, or credentials discussed during sessions.\n- [COMMAND_EXECUTION]: The instructions in SKILL.md direct the agent to take a user-supplied range and insert it into a shell command: node <skill-dir>/analyze-sessions.mjs --json --since <range>. This creates a command injection surface where a malicious user could execute arbitrary code by providing a payload containing shell metacharacters.\n- [DATA_EXFILTRATION]: The generated HTML report includes actual prompt text and transcript context (neighboring messages) for expensive calls. This design facilitates the extraction of sensitive conversation data into a self-contained file, increasing the risk of accidental information disclosure if shared.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from historical session transcripts to generate a summary and detect anomalies.\n
Ingestion points: Session transcript files located at ~/.claude/projects/**.jsonl.\n
Boundary markers: No delimiters or safety instructions are provided to prevent the agent from following malicious instructions that may be embedded within the transcripts.\n
Capability inventory: The skill can execute shell commands, read/copy files, and modify local file content.\n
Sanitization: There is no validation or sanitization of transcript content before it is analyzed by the agent for report generation.

session-report