The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process 'project memory' from various external sources (such as mem0, SQLite databases, and session transcripts) to generate new agent instructions (SKILL.md). This creates a significant surface for indirect prompt injection, as malicious instructions hidden in the history or notes could be promoted into permanent, auto-loading repository skills.
Ingestion points: As detailed in references/memory-backends.md, the skill reads from mem0, local SQLite databases (~/.claude-mem/claude-mem.db), and filesystem notes (MEMORY.md, .cursor/memory/).
Boundary markers: The skill lacks explicit boundary markers or 'ignore' instructions for the raw memory data being processed.
Capability inventory: The skill has the capability to write files to the local repository and execute shell commands for verification.
Sanitization: There is no evidence of sanitization or filtering for the external memory content beyond the agent's own 'curation' logic.
[COMMAND_EXECUTION]: During the verification phase (SKILL.md step 4), the agent is instructed to 'run relevant commands' to verify claims made in the memory. If the memory content is attacker-controlled, this could lead to the execution of malicious shell commands under the guise of verification.
[DATA_EXPOSURE]: The skill is configured to locate and access local memory stores, such as the claude-mem database, which can contain sensitive session history and project-specific information.
[PERSISTENCE]: The skill creates persistent functional changes by writing SKILL.md files to directories intended for automatic loading (.agents/skills/), ensuring that the distilled (and potentially compromised) instructions persist across future agent sessions.

distill-skill