The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/agent-transcript executes the codex command using node:child_process.spawn to communicate with a local application server for reading thread history.
[DATA_EXFILTRATION]: The skill accesses sensitive local directories to retrieve session logs, including ~/.codex/sessions, ~/.claude/projects, ~/.pi/agent/sessions, and ~/.openclaw/agents. It implements a redact function using regex to filter out private keys, API tokens, emails, and local paths before displaying or inserting the transcript.
[INDIRECT_PROMPT_INJECTION]: The skill processes session logs which contain untrusted data from previous agent turns, creating a potential surface for indirect injection.
Ingestion points: Local .jsonl session logs are read by scripts/agent-transcript in the readJsonl function and via appServerThreadRead for Codex threads.
Boundary markers: SKILL.md contains explicit instructions for the agent to trim the transcript to relevant turns and drop system prompts or environment data before showing it to the user.
Capability inventory: The skill has the ability to read and write local files and execute the codex binary via spawn.
Sanitization: The script uses a multi-layered approach including regex-based redaction for PII and secrets, as well as an unsafe() function that checks for residual sensitive patterns (like Bearer tokens or session cookies) to block the output if detection fails.

openclaw-agent-transcript