The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it summarizes external content from git history and tool sessions.\n
Ingestion points: The script scripts/collect.py reads commit messages and prompt strings from Claude Code and Cursor session databases.\n
Boundary markers: There are no explicit delimiters in the prompt template in SKILL.md to distinguish untrusted content from instructions.\n
Capability inventory: The skill uses subprocess.run to execute git and can read files from the home directory.\n
Sanitization: Raw data is processed directly for summarization without filtering or escaping.\n- [DATA_EXFILTRATION]: The skill accesses local application data which contains sensitive interaction history.\n
Evidence: It reads from ~/.claude/projects and ~/Library/Application Support/Cursor/User/workspaceStorage to extract session metadata and first prompts.\n- [COMMAND_EXECUTION]: The skill executes local shell commands to gather data.\n
Evidence: It uses subprocess.run to call git log on repositories in the workspace. Additionally, the bash command in SKILL.md interpolates environment variables like GIT_AUTHOR which could lead to command substitution if those variables contain malicious sequences.

worklog-report