The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-generated conversation transcripts from Claude Code's store to identify content worth persisting. This processing of untrusted data introduces a risk where malicious instructions within a transcript could influence the agent's behavior during the harvest procedure.
Ingestion points: Reads Claude Code's transcripts and background-job state from ~/.claude (specifically referenced in SKILL.md).
Boundary markers: The skill mentions using tool-use id to match answers and turns, which helps in correctly attributing content within the transcript.
Capability inventory: The skill has significant capabilities including writing to local repository files (plans/*.md, AGENTS.md), executing system commands (git, gh, docker), and proposing the termination of processes.
Sanitization: The instructions state that commands should not be run through a shell, and results are primarily reported to stdout or written to specific local files.
[COMMAND_EXECUTION]: The skill performs extensive system state auditing by executing commands such as ps, ss, netstat, git, gh, and docker. The underlying script (scripts/harvest.py) uses subprocess.run to facilitate these operations. While these are required for functionality, they represent a potential attack surface if command arguments are derived from unsanitized transcript content.

session-harvest