The Agent Skills Directory

Prompt Injection (LOW): The skill is vulnerable to indirect prompt injection via the session recovery mechanism.
Ingestion points: scripts/session-catchup.py reads conversation history from JSONL files in ~/.claude/projects/.
Boundary markers: The script uses --- UNSYNCED CONTEXT --- as a delimiter but does not include explicit instructions for the agent to ignore potentially malicious embedded commands within the history.
Capability inventory: The skill has access to powerful tools including Bash, Write, and Edit, and executes shell hooks during Stop and PreToolUse events.
Sanitization: The script performs minimal sanitization (excluding specific tags like <local-command) but generally presents raw text from previous sessions back to the LLM.
Command Execution (SAFE): The skill utilizes local shell and PowerShell scripts for task verification and initialization.
Evidence: Hooks in SKILL.md execute scripts/check-complete.sh and scripts/check-complete.ps1.
Context: These scripts are bundled with the skill and perform benign logic (counting status markers in markdown files). The use of -ExecutionPolicy Bypass in PowerShell is a standard requirement for agent-run scripts and is used only on local skill files.
Data Exposure (SAFE): The skill accesses the agent's own project history directory (~/.claude/projects/). While this directory contains sensitive conversation data, accessing it is the primary and stated purpose of the session-catchup.py script to facilitate context recovery. No data exfiltration to external domains was detected.

planning-with-files