The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses private conversation history from ~/.claude/projects/ and writes it to a temporary directory in /tmp using a naming scheme based on a simple timestamp. Because /tmp is typically world-readable, this practice can expose sensitive user data to other users or processes on the same local system.
Evidence: Step 2 script initializes a scratch directory in /tmp and redirects user and assistant messages into text files within that directory.
[INDIRECT_PROMPT_INJECTION]: The skill ingests raw conversation history and passes it to subagents for analysis. These logs constitute untrusted data that may contain malicious instructions from previous sessions. The subagent prompt lacks boundary markers or instructions to ignore embedded commands, creating a vulnerability surface.
Ingestion points: JSONL files located in ~/.claude/projects/ extracted in Step 2.
Boundary markers: None provided in the prompt template for subagents in Step 3.
Capability inventory: File system read/write access and local shell command execution.
Sanitization: Minimal; data is filtered for empty assistant messages but not for executable or instruction-based content.
[COMMAND_EXECUTION]: The skill utilizes multiple local shell commands to find and transform data.
Evidence: Use of sed, ls, mkdir, cat, jq, and grep to manage project paths and conversation logs.

review-claudemd