The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's primary script, scripts/agent-transcript, scans and reads sensitive session logs from multiple AI agent platforms located in high-value directories within the user's home folder.
The script targets paths including ~/.codex/sessions, ~/.claude/projects, ~/.pi/agent/sessions, and ~/.openclaw/agents.
These log files typically contain the full history of user prompts and tool outputs, which may include sensitive source code, configuration details, or credentials inadvertently shared with an agent.
While the script implements a redaction function to replace common patterns (OpenAI keys, private keys, auth headers, etc.), the wide-scale access to directories belonging to other vendors' agents represents a significant security risk to the user's data privacy.
[COMMAND_EXECUTION]: The script performs local command execution by spawning a subprocess for the codex CLI tool.
It specifically uses node:child_process.spawn to run codex app-server --listen stdio:// to read thread data. This allows the skill to programmatically interact with the local agent environment and its internal data streams.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted session data and renders it into a format intended for publication (e.g., GitHub PR descriptions), creating an attack surface for indirect prompt injection.
Ingestion points: The tool discovers and parses .jsonl session files from across the local filesystem, as defined in the walkJsonl and defaultRoots functions.
Boundary markers: The skill uses  and  delimiters to manage the transcript section in markdown files.
Capability inventory: The skill can execute local commands (codex), write files to /tmp/, and is designed to modify GitHub PR/Issue bodies via the primary agent's capabilities.
Sanitization: Although it uses regex-based redaction and automated trimming of system prompts, the SKILL.md instructions explicitly warn that "helper redaction is not sufficient disclosure review," acknowledging that sensitive or malicious content could persist in the output.

openclaw-agent-transcript