The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses highly sensitive local directories where other AI agents store their conversation histories, including ~/.claude, ~/.pi, and ~/.codex. These files frequently contain PII, proprietary code, and potentially hardcoded credentials from past development sessions. While the skill includes instructions to drop secrets during extraction, the initial access to these paths constitutes significant data exposure.
[COMMAND_EXECUTION]: The instructions require the agent to execute bundled Node.js scripts (readers/claude_code.mjs, readers/codex.mjs, readers/pi.mjs) which use system modules to traverse the filesystem and query local SQLite databases.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from session transcripts. A malicious actor could inject instructions into a previous session (e.g., via a poisoned code comment or metadata) that the extraction prompts might inadvertently follow when processing the history, potentially poisoning the agent's long-term knowledge base.
Ingestion points: Session transcripts read by readers/*.mjs from local app data paths (JSONL and SQLite files).
Boundary markers: The extraction prompts use structured blocks like {{MOST_RECENT_MESSAGES}} and explicit instructions to "ONLY ANALYZE" specific windows to provide some level of isolation.
Capability inventory: The agent using this skill is capable of writing extracted entities (topics, people, facts, events) into its persistent memory stores, knowledge graphs, or diary systems.
Sanitization: The prompts include guidelines to drop secret-shaped values and focus on explicit statements, but the raw content from transcripts is interpolated into prompts without explicit escaping or filtering of control characters.

memory-collector