The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large external text files (literary works) into a structured memory system. If a source file contains malicious instructions formatted as narrative text or metadata, an agent might interpret them as instructions rather than data.
Ingestion points: Instructions in SKILL.md direct the agent to read source text using tools like bm cat or sed.
Boundary markers: The workflow does not specify the use of delimiters or 'ignore embedded instructions' prompts when reading the source text.
Capability inventory: The agent has tools to create and modify notes (write_note, edit_note), create projects (create_memory_project), and execute shell commands via the bm CLI.
Sanitization: No sanitization or validation of the input text content is performed before the agent processes it into the knowledge graph.
[COMMAND_EXECUTION]: The skill provides complex Bash scripts for validation and coverage checks that interpolate user-provided placeholders directly into shell commands.
Evidence: The 'Coverage Checks' section includes a Bash while loop that uses the <work> placeholder within a command-line string: bm find ... --project <work> --json.
Risk: If the project name or work identifier is sourced from untrusted input and not properly sanitized, it could lead to local command injection.

memory-literary-analysis