The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute bash commands in SKILL.md using unvalidated user inputs for [query], [url], and [path]. Commands such as ghq get -u "$URL", find ... -name "*[query]*", and grep -r "[query]" are vulnerable to command injection if a user or an indirect source provides values containing shell metacharacters like backticks or subshell expansions.
[DATA_EXFILTRATION]: The scripts/dig.py script reads Claude Code session logs (.jsonl files) from the PROJECT_DIRS environment path. These logs contain the full history of interactions, which may include sensitive code, business logic, or credentials discussed in previous sessions. The skill then distills this data into trace logs that are intended to be committed to version control.
[EXTERNAL_DOWNLOADS]: The skill uses the ghq tool to clone repositories from arbitrary external URLs provided by the user in the [url] parameter.
[PROMPT_INJECTION]: The skill is highly susceptible to indirect prompt injection due to the ingestion of untrusted data from git logs, repository files, and GitHub issues/PRs. Ingestion points: Git history, remote repository files, session logs, and GitHub issue/PR descriptions. Boundary markers: None; search results are compiled into a trace log without delimiters or warnings. Capability inventory: Filesystem writes to ψ/memory/traces/, shell execution of find, grep, git, and gh, and tool calls to arra_trace. Sanitization: None; the skill interpolates raw external content into agent prompts and markdown files.

trace