The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/find_transcript.py uses subprocess.run to execute git commands (such as rev-parse, blame, and show) for commit resolution and repository metadata retrieval. Evidence: The run_git function implements subprocess.run using argument lists without the shell, which correctly prevents command injection vulnerabilities from user-supplied file paths or commit SHAs.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of Claude Code session transcripts (.jsonl files) which could contain malicious instructions from previous agent interactions.\n
Ingestion points: The load_transcript_records function in scripts/find_transcript.py reads transcript files from the user's ~/.claude/projects directory.\n
Boundary markers: SKILL.md provides instructions for the agent to treat excerpts as evidence rather than ground truth, but the script output lacks technical delimiters or explicit warnings to isolate the untrusted transcript content from the agent's instructions.\n
Capability inventory: The script performs local file reads and executes git commands via subprocess.run.\n
Sanitization: The clean_text function in scripts/find_transcript.py removes known noise prefixes and tool markers (e.g., <command-message>) but does not perform sanitization of potential prompt injection strings within the transcript text body.

recall-rationale