The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the current conversation session to update long-term memory files. This creates a vulnerability surface where malicious instructions embedded in session observations could be persisted and later influence agent behavior.
Ingestion points: Session observations are captured and appended to .claude/memory/MEMORY.md (Step 1).
Boundary markers: The skill includes a 'human-in-the-loop' requirement, stating that anything promoted to rules or concepts needs the user's verbal 'yes' first. It also implements an auditing process (Step 2) requiring a pattern to appear on 3+ different dates before promotion.
Capability inventory: The skill uses Write, Edit, and Bash tools to modify project files including .claude/rules/, knowledge/concepts/, and projects/*/README.md (Step 2 and project map check).
Sanitization: There is no explicit content filtering or escaping mentioned; the skill relies on the frequency audit and user confirmation as primary mitigations.
[COMMAND_EXECUTION]: The skill is configured to use the Bash tool to perform file operations, searching (Grep), and file system traversal (Glob). These tools are used to maintain project structure and prune memory files as part of the session wrap-up ritual.

close-session