The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill manages persistent memory files that store information derived from user conversations, creating a potential surface for indirect prompt injection across sessions.
Ingestion points: Content is loaded using read_file and deep_recall_memory from .md files in the .agent_memories/ directory.
Boundary markers: The instructions do not specify the use of clear delimiters or instructions to treat the retrieved memory as potentially untrusted data.
Capability inventory: The skill is configured to use read_file, edit_file, and deep_recall_memory to manage the local file system.
Sanitization: Although there is a rule to exclude sensitive data like passwords and tokens, there are no instructions for sanitizing or escaping the content when it is interpolated back into the agent's context.

memory-management