The Agent Skills Directory

[SAFE]: The skill provides a robust framework for managing agent memory locally. It follows best practices for Claude Code extensions, including the use of state-saving hooks and user-invocable slash commands.
[PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection because it automatically captures conversation patterns and re-injects them into the agent's context in future sessions.
Ingestion points: Conversation history is recorded into .claude/memory/MEMORY.md and context/handoffs/ files (e.g., in session-start.py).
Boundary markers: Injected context is delimited by Markdown headers and descriptive labels to provide structural clarity to the agent.
Capability inventory: The skill has file-writing capabilities and can execute local Python scripts via subprocess calls in the query.py and session-start.py files.
Sanitization: No automated sanitization of captured text is performed; however, the skill mandates a manual audit ritual (/close-session) where the agent must propose any permanent memory promotions (rules or concepts) to the user for verbal approval before writing them.
[COMMAND_EXECUTION]: The skill executes local Python scripts and the claude CLI tool to perform maintenance tasks and knowledge searches. These executions (found in query.py, lint.py, and session-start.py) use list-based arguments and fixed local paths, preventing shell injection vulnerabilities.
[DATA_EXFILTRATION]: No evidence of data exfiltration was found. Network-related permissions in .claude/settings.json (WebSearch, WebFetch) are standard for agent operations, and the skill's custom scripts do not perform any external network requests.
[EXTERNAL_DOWNLOADS]: The skill does not perform any remote script downloads or third-party package installations. All logic is contained within the provided local scripts.

claude-memory-kit