The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session transcripts to extract and re-inject facts into the agent's context, creating an indirect prompt injection surface. However, this is mitigated by a multi-stage promotion logic that requires facts to recur across multiple sessions and calendar days, and a mandatory human review step ('adopt' command) before any memory is committed to the project's durable configuration. \n
Ingestion points: scripts/memory_extract.py reads JSONL transcripts from ~/.claude/projects/.\n
Boundary markers: Memory atoms are injected into context; contested claims are explicitly tagged with conflict notes.\n
Capability inventory: Local file read/write, string/regex processing. No network access or subprocess execution.\n
Sanitization: scripts/memory_core.py implements a comprehensive lexical redaction filter targeting AWS keys, GitHub tokens, API keys (Anthropic, OpenAI, Google, Stripe), private keys, JWTs, and database connection strings. \n- [DATA_EXFILTRATION]: No network exfiltration vectors were detected. The skill specifically avoids external dependencies and network calls ('stdlib only'). It handles local files with restricted permissions (0600/0700) and de-identifies paths before promotion to L2/L3 by stripping OS usernames from back-pointers. \n- [COMMAND_EXECUTION]: The skill uses local Python scripts for its operations. These scripts are self-contained, do not invoke external binaries, and avoid dangerous functions like eval() or exec() for processing external data.

agent-memory