The Agent Skills Directory

[DATA_EXPOSURE]: The skill includes a session recovery feature (session-catchup.py) that reads local session history logs from standard locations such as ~/.claude/projects/, ~/.codex/sessions/, and ~/.local/share/opencode/. This is used solely to identify unsynced context for project restoration and is a documented core functionality of the skill.
[INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion point for external data (research findings, session history, and task plans) which could potentially contain adversarial instructions. It implements exemplary defensive measures to mitigate this risk, including:
SHA-256 Attestation: Uses a cryptographic hashing mechanism (attest-plan.sh/.ps1) to lock the task plan. The skill refuses to inject the plan into the model context if the file content diverges from the approved hash.
Nonce-Delimited Injection: In v3 modes, plan data is wrapped in delimiters containing a session-specific 16-hex nonce, protecting against delimiter-confusion injections.
Containment Guards: Employs path canonicalization (using realpath or Python) to verify that all resolved plan directories reside within the project root, effectively preventing directory traversal attacks.
Instruction Overrides: Automatically injects defensive prompts instructing the agent to treat plan content as structured data rather than instructions.

planning-with-files