The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon durable memory files, which constitutes a potential attack surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: Reads memory data from local and runtime-specific files (e.g., .md, .json, .yaml) as outlined in SKILL.md and references/store-adapters.md.
Boundary markers: The skill includes extensive instructions in SKILL.md and references/memory-contract.md to distinguish between 'evidence' and 'inference', require provenance citations, and treat memories as 'claims' rather than absolute truths.
Capability inventory: The skill uses python3 scripts/inventory_memory.py to scan the filesystem and implies the ability to read/write/delete files within defined memory stores.
Sanitization: The skill mandates mutation gates (explicit user approval for writes/deletes) and provides a 'Memory Contract' that forbids the storage of secrets and requires verification of drift-prone claims.
[COMMAND_EXECUTION]: The workflow involves executing a local utility script, scripts/inventory_memory.py, which performs filesystem operations to identify candidate memory files.
Evidence: SKILL.md instructs the agent to use python3 scripts/inventory_memory.py ROOT for inventorying files.
Mitigation: The script is restricted to metadata-only access (file paths, sizes, and timestamps) and explicitly skips hidden directories, symlinks, and standard development folders (e.g., node_modules).

memory