The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted conversational data and processes it using Large Language Models to extract facts and generate answers.
Ingestion points: User-provided conversation history is ingested via CLI commands (add and import) and stored in a local LanceDB database (src/database/vector_store.py).
Capability inventory: The skill possesses the capability to perform network requests to the OpenRouter API for text generation and embeddings (src/utils/openrouter.py) and write to the local filesystem for database management.
Boundary markers: The prompt templates in MemoryBuilder._build_extraction_prompt and AnswerGenerator._build_answer_prompt use plain text headers to separate system instructions from user data but do not employ robust delimiters or explicit "ignore embedded instructions" directives to prevent the model from following commands contained within the conversation history.
Sanitization: Conversational content is interpolated directly into prompts without sanitization or escaping of potential injection payloads.

simplemem-skill