The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill executes Python code at runtime using python3 -c to extract timestamps and message snippets from session history files.\n- [DYNAMIC_EXECUTION]: In --bg mode, the skill attempts to locate a script (dig-session.py) by searching across multiple directories, including ~/.claude/plugins/cache/, and executes the first match found. This dynamic loading and execution of code from computed or cached paths poses a risk if an attacker can influence the contents of those directories.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes *.jsonl files from the user's session history directory (~/.claude/projects/) which contain raw, unvalidated message content from previous interactions. This data is fed into subagents and the main agent to generate summaries and timelines.\n
Ingestion points: The skill reads session history JSONL files in SKILL.md, DEEP.md, and TEAMMATE.md.\n
Boundary markers: No explicit delimiters or instructions are used to ensure the agent ignores potential commands embedded in the processed session history.\n
Capability inventory: The skill can execute shell commands, write files to the local repository vault, and spawn additional subagents.\n
Sanitization: The extraction script performs basic JSON field parsing but does not sanitize or filter the message text for prompt injection patterns.\n- [COMMAND_EXECUTION]: The skill uses various shell commands (git, ls, mkdir, sed, basename) to gather environment context and manage retrospective files. While necessary for its core functionality, these commands increase the impact of a successful injection.

rrr