The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes session transcripts from various platforms to identify "candidates" for permanent project instructions. This creates a surface for indirect prompt injection, where malicious instructions present in the session history (e.g., from external content the agent processed earlier) could be persisted into the project's root instruction files.
Ingestion points: Platform-specific transcript files (e.g., ~/.claude/projects/*.jsonl, ~/.cursor/.../*.jsonl, ~/.copilot/session-state/*.jsonl) defined in HARNESSES.md.
Boundary markers: The skill lacks explicit instructions to disregard or sanitize embedded commands within the ingested transcripts.
Capability inventory: The skill modifies the repository's core instruction files (CLAUDE.md, AGENTS.md) and can create new project skills in directories like .agents/skills/.
Sanitization: No explicit filtering or sanitization of transcript content is performed during the extraction process.
[DATA_EXFILTRATION]: The skill accesses sensitive session logs and native memory stores located in the user's home directory (e.g., ~/.claude/projects/, ~/.cursor/projects/, ~/.copilot/session-store.db). These files contain histories of user interactions that may include sensitive information or credentials shared during the session.
[COMMAND_EXECUTION]: The skill utilizes git status and git diffing to analyze repository state and identify relevant artifacts modified during the session.

harvest