The Agent Skills Directory

[DATA_EXPOSURE]: The skill reads conversation logs (*.jsonl) and usage metadata (facets/*.json) from the ~/.claude/ directory. These files contain the history of all user interactions, which may include sensitive information, private data, or credentials shared during past sessions.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of processing historical data to create new system rules.
Ingestion points: Ingests historical conversation logs (~/.claude/projects/.../*.jsonl) and session insights (~/.claude/usage-data/facets/*.json) which contain arbitrary user-provided content from previous sessions.
Boundary markers: None. The logic does not define delimiters or instructions to distinguish between intended user feedback and potentially malicious instructions hidden in past data.
Capability inventory: The skill uses high-privilege tools such as Edit, Write, Bash, and WebFetch to apply the resulting "improvements" to global and project-specific configuration files.
Sanitization: None mentioned. The skill identifies "signals" from raw message content and proposes them as permanent configuration changes without sanitization or safety checks beyond a user confirmation step.
[EXTERNAL_DOWNLOADS]: Fetches best practice guidelines and documentation from official Anthropic and Claude Code domains, such as code.claude.com, www.anthropic.com, and claude.com to validate proposed changes.
[COMMAND_EXECUTION]: Executes shell commands via the Bash tool, specifically calling the claude CLI with the /insights parameter to generate session metadata and using date for timestamping logs.

retro