The Agent Skills Directory

[DATA_EXFILTRATION]: The skill instructs the agent to access and process sensitive session transcript files located in ~/.claude/projects/ and ~/.codex/sessions/. These transcripts contain a history of user interactions which may include sensitive information, credentials, or private project data.
[REMOTE_CODE_EXECUTION]: The skill utilizes the npx skills CLI to add and update agent skills from external GitHub repositories. This facilitates the introduction and subsequent execution of code from third-party sources into the agent's environment.
[COMMAND_EXECUTION]: The skill performs several command-line operations, including using npx to run the skills utility, creating symbolic links with ln -s, and executing a Python script (scripts/session-usage.py) to process transcript data.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from previous session transcripts. If those transcripts contain malicious instructions embedded by an attacker in a previous interaction, the agent might process them during efficiency or usage audits.
Ingestion points: Session transcript files (.jsonl) read by scripts/session-usage.py.
Boundary markers: No boundary markers or isolation techniques are present in the provided scripts to distinguish between transcript data and instructions.
Capability inventory: File system modification, skill installation via npx, and command execution.
Sanitization: The Python script parses JSON and extracts text but does not perform sanitization or validation of the content for embedded instructions.
[DYNAMIC_EXECUTION]: The skill is a meta-utility designed to generate, modify, and manage other agent instructions and skills which are then executed or loaded in future sessions.

maintain-environment