The Agent Skills Directory

Indirect Prompt Injection Surface: The skill reads and summarizes Claude Code session transcripts, which could potentially contain adversarial text if the user interacted with untrusted source code or inputs.
Ingestion points: The script analyze-sessions.mjs walks through and streams logs from ~/.claude/projects/**.jsonl files.
Boundary markers: There are no dedicated adversarial boundary checks during transcript parsing, although data is parsed strictly as structure-bound JSONL.
Capability inventory: The skill invokes local script execution (node) and file modification commands to embed data into a local report, with no active outbound network connections.
Sanitization: Preview text formatting strips HTML bracket markers via basic regular expressions in analyze-sessions.mjs, and the static template template.html applies a dedicated character escaping function (esc()) to neutralize markup elements before rendering tables.
External Resource Reference: The HTML template includes references to Google Web Fonts for presentation.
Evidence: Links to fonts.googleapis.com and fonts.gstatic.com are defined in the head section of template.html to load fonts at render time.

session-report