The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses highly sensitive session logs located in ~/.claude/projects/. These files contain full conversation histories, including potential secrets or proprietary code discussed in previous sessions. While this access is the primary purpose of the 'recall' functionality, it represents a significant data exposure surface.
[COMMAND_EXECUTION]: The script scripts/session-graph.py utilizes subprocess.run(['open', output_path]) to launch the generated HTML graph in the user's default web browser. While used here for user convenience, executing system commands on file paths is a high-privilege operation.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). Malicious instructions stored in historical session logs could be 'recalled' into the current agent context.
Ingestion points: Reads historical JSONL session logs in scripts/recall-day.py and scripts/extract-sessions.py.
Boundary markers: The skill lacks explicit 'ignore embedded instructions' delimiters when presenting recalled text to the agent.
Capability inventory: The skill has access to Bash and python3 tools as defined in SKILL.md.
Sanitization: Uses regex STRIP_PATTERNS to remove system tags and tool noise, but does not sanitize general natural language instructions.
[EXTERNAL_DOWNLOADS]: The visualization tool scripts/session-graph.py generates HTML that depends on the pyvis library. When rendered, the browser fetches the vis-network JavaScript assets from a remote CDN (unpkg.com). This is a standard but external dependency for the graph's interactive features.

recall