The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive session logs stored in ~/.claude/projects/. These logs contain the full history of user interactions, tool results, and project context, which may include proprietary code or secrets.\n
Evidence: scripts/mine_session_logs.py defines claude_dir = Path.home() / ".claude" / "projects" and iterates through these directories to parse session data.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted session data and interpolates it into prompts for the Claude CLI. Malicious instructions embedded in tool outputs or user messages within the mined logs could influence the agent's behavior during the abstraction and scoring stages.\n
Ingestion points: scripts/mine_session_logs.py reads JSONL session logs from the local Claude projects directory.\n
Boundary markers: The prompts in scripts/mine_session_logs.py and scripts/score_ideas.py use markdown headers (e.g., ## Signals, ## User Message Samples) but lack explicit escaping or instructions to ignore embedded commands within the log content.\n
Capability inventory: The skill executes the claude CLI via subprocesses and performs file system operations (read/write) for reports and backlogs.\n
Sanitization: While error samples are truncated, there is no validation or sanitization of the content extracted from logs before it is interpolated into LLM prompts.\n- [COMMAND_EXECUTION]: The scripts invoke the claude CLI using subprocess calls to perform LLM-based abstraction and scoring tasks. It also explicitly removes environment variables to bypass recursion detections.\n
Evidence: scripts/mine_session_logs.py and scripts/score_ideas.py both contain subprocess.run(["claude", "-p", ...]) calls and manipulate os.environ to remove the CLAUDECODE variable.\n- [PERSISTENCE]: The skill documentation recommends setting up scheduled execution via system persistence mechanisms.\n
Evidence: SKILL.md instructs the user to set up a "Weekly automated pipeline run (Saturday 06:00 via launchd)".

skill-idea-miner