The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a workflow for reading potentially untrusted data from a memory file (MEMORY.md) and writing it to critical configuration files (CLAUDE.md). This creates a vulnerability surface where a user could potentially inject instructions into the agent's memory that are later 'promoted' to permanent rules.
Ingestion points: MEMORY.md (Step 2 and 6).
Boundary markers: The skill lacks explicit delimiters to separate promoted content from the rest of the rule file.
Capability inventory: File system write access to project rule files (Step 5).
Sanitization: No programmatic sanitization is performed, though the skill instructions require the agent to 'distill' the notes into instructions, providing a manual cognitive filter.
[COMMAND_EXECUTION]: The skill instructions include shell commands like grep, sed, and pwd used to locate and search the agent's internal memory storage. These commands are used for local path resolution and do not pose a risk of arbitrary code execution.

promote