The Agent Skills Directory

[PROMPT_INJECTION]: The skill defines a protocol for managing persistent context through files that are automatically or conditionally loaded into the agent's prompt environment. This creates a surface for indirect prompt injection, as malicious instructions encountered in external content could be persisted in memory and executed in future sessions.
Ingestion points: MEMORY.md is automatically loaded into the system prompt at the start of sessions, while supplemental topic files are accessed on-demand from the ~/.claude/ directory.
Boundary markers: The instructions do not specify the use of boundary markers or instructions to treat memory content as untrusted, increasing the risk of the agent obeying embedded instructions.
Capability inventory: The agent context typically includes capabilities for file system operations and shell execution, providing a path for exploitation if malicious instructions are successfully injected.
Sanitization: There are no requirements or methods specified for sanitizing or validating information before it is written to the persistent memory files.

session-memory-manager