The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads user-controlled Markdown files to retrieve "experience" or "knowledge," which introduces a surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: The query_notes function in scripts/write-memory.py reads content from Markdown files within the user-configured memory_root.
Boundary markers: The SKILL.md provides explicit instructions to the agent to treat retrieved knowledge as reference material and not let it override current user commands or environment facts.
Capability inventory: The skill can read, write, and append to Markdown files and execute local helper scripts.
Sanitization: The assert_path_within_root function in scripts/write-memory.py uses Path.relative_to to enforce that all file operations remain within the user-specified directory, preventing path traversal attacks.
[COMMAND_EXECUTION]: The skill utilizes local PowerShell, Shell, and Python scripts to facilitate memory management operations.
Evidence: The SKILL.md instructs the agent to invoke scripts/write-memory.ps1, scripts/write-memory.sh, or scripts/write-memory.py for all initialization and data operations. These scripts are self-contained and do not perform network operations or unauthorized system modifications.

agent-offline-mermory