The Agent Skills Directory

DATA_EXFILTRATION / SENSITIVE DATA ACCESS (HIGH): The skill is designed to read and modify ~/.claude/history.jsonl and ~/.claude/projects/, which contain private conversation history, tool results, and session metadata. Accessing these files constitutes sensitive data exposure.
INDIRECT PROMPT INJECTION (HIGH): The skill ingests untrusted data from history.jsonl and sessions-index.json to perform rewrites.
Ingestion points: ~/.claude/history.jsonl, ~/.claude/projects/**/sessions-index.json (referenced in SKILL.md and session-storage-anatomy.md).
Boundary markers: None specified; the skill performs string or JSON replacement on entries that may contain attacker-controlled content from previous agent interactions.
Capability inventory: Use of Bash and Read tools to execute claude-code-migrate.sh which performs file moves and content rewriting.
Sanitization: No sanitization logic is described for handling malicious payloads embedded within the JSONL history files.
COMMAND_EXECUTION / REMOTE CODE EXECUTION (HIGH): The skill executes a local shell script scripts/claude-code-migrate.sh with broad permissions (via the Bash tool) to modify the filesystem and environment tools like mise and uv.
Evidence: SKILL.md Phase 2 and 3 explicitly trigger script execution: bash "<skill-scripts>/claude-code-migrate.sh" --dry-run "$OLD_PATH" "$NEW_PATH".
Note: The content of the .sh script was not provided for analysis, making its safety unverifiable.
PRIVILEGE ESCALATION / PERSISTENCE (MEDIUM): The skill modifies environment tool states (e.g., mise trust <path>) and recreates virtual environments (uv sync). While contextually relevant, these actions can be used to authorize malicious scripts or persist changes in the user's development environment.

project-directory-migration