The Agent Skills Directory

[DATA_EXPOSURE]: The skill explicitly directs the agent to access and read sensitive session transcript files located within the user's home directory.
Evidence: Accesses ~/.claude/projects/<project>/<session-id>.jsonl to retrieve Claude Code session history.
Evidence: Accesses files under ~/.codex/sessions/ to retrieve Codex session history.
Evidence: Uses the herdr CLI tool to query session IDs and pane metadata, potentially exposing internal session state.
[INDIRECT_PROMPT_INJECTION]: The skill ingests historical transcript data which may contain untrusted content that could influence the agent's behavior in the current session.
Ingestion points: Transcript files in ~/.claude/projects/ and ~/.codex/sessions/ are read into the agent's context (SKILL.md, Section 2).
Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between benign historical data and potentially malicious instructions embedded in the transcripts.
Capability inventory: The skill is designed to "continue the work," which involves executing arbitrary tools, editing files, and performing network operations in the current session's workspace based on the read transcript.
Sanitization: The instructions do not mention any sanitization, filtering, or validation of the transcript content before it is processed by the agent.

continue-session