The Agent Skills Directory

[DATA_EXPOSURE]: The skill accesses session logs in ~/.claude/projects/ and ~/.codex/sessions/. These logs contain full transcripts of AI interactions, including code, user queries, and tool outputs, which may contain sensitive information or credentials.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted interaction history as data. A previous session could contain malicious payloads designed to influence the agent's behavior during the audit process.
Ingestion points: Session logs (*.jsonl) from Claude Code and Codex harnesses.
Boundary markers: The skill employs a high-effort subagent to process raw logs, keeping them out of the main agent's context window.
Capability inventory: File system access via ls and read for logs and rule files; write capability for the hub repository rule files.
Sanitization: The instructions explicitly require the redaction of secrets and home directory paths before reporting results to the user.- [COMMAND_EXECUTION]: The skill utilizes ls to verify the existence of log directories and file paths before processing. It also audits command execution history for risky patterns such as kill, rm -rf, and git reset.

audit-agent-history