The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/ingest.py uses importlib.import_module to dynamically load adapter modules from the adapters/ sub-package. The specific module to load is determined at runtime based on the --adapter argument or automatic detection of the source file type.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and process large volumes of untrusted data (chat exports, notes, social media) to build a persona wiki, which presents a surface for indirect prompt injection.
Ingestion points: Untrusted data enters via scripts/ingest.py and is stored in MemPalace (SQLite/ChromaDB).
Boundary markers: The instructions in SKILL.md for the wiki building phase lack specific guidance on using delimiters or ignoring embedded instructions when the agent reads from the stored memories.
Capability inventory: The agent possesses Write and Bash capabilities, which could be misdirected by instructions hidden within the ingested chat or note content.
Sanitization: While a PII scanner exists to flag sensitive information, there is no content sanitization to strip or neutralize potential prompt injection attacks before the agent processes the data.
[COMMAND_EXECUTION]: The skill includes developer-focused scripts such as publish.sh and tests/test_scripts.py that execute shell commands and subprocesses to package the skill or run its internal scripts.
[CREDENTIALS_UNSAFE]: The chat_export adapter specifically targets the macOS iMessage database at ~/Library/Messages/chat.db. Accessing this file involves reading highly sensitive personal communications. Additionally, the PII scanner in scripts/ingest.py is configured to detect and flag hardcoded passwords (password, passwd, pwd) within the processed datasets.

persona-knowledge