The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted conversation history to generate instructions for future sessions, creating a surface for indirect prompt injection. \n
Ingestion points: ~/.claude/ccrecall.db and current conversation context (referenced in references/analysis-patterns.md). \n
Boundary markers: The instructions lack explicit boundary markers or warnings to disregard instructions embedded within the conversation data being analyzed. \n
Capability inventory: The skill has the capability to modify global (~/.claude/CLAUDE.md) and project-level (.claude/CLAUDE.md) instruction files which govern agent behavior (referenced in references/hierarchy.md). \n
Sanitization: There is no requirement for sanitization or validation of the extracted content before it is written to persistence files. \n- [DATA_EXFILTRATION]: The skill directs the agent to access sensitive local data. \n
Evidence: references/analysis-patterns.md directs the agent to open and query ~/.claude/ccrecall.db to extract message history, which contains private user conversation logs. \n- [METADATA_POISONING]: The skill's metadata contains misleading information. \n
Evidence: The SKILL.md frontmatter lists a last_updated date of 2026-05-15, which is in the future.

reflect