The Agent Skills Directory

[PROMPT_INJECTION]: The skill architecture creates a surface for indirect prompt injection by instructing the agent to treat retrieved knowledge as "constraints" that must be followed. This could allow an attacker to inject malicious instructions into the project memory that the agent subsequently obeys.
Ingestion points: Data is ingested through the record.mjs script, which persists content into HTML files within a context-tree/ directory.
Boundary markers: The skill uses a structured HTML vocabulary (e.g., <bv-fact>, <bv-rule>) to segment data, but it lacks explicit boundaries or instructions that prevent the agent from obeying commands embedded within these tags.
Capability inventory: The agent has access to a Bash tool used to execute Node.js scripts and manage the local file system.
Sanitization: The skill does not describe any sanitization or filtering of memory content before it is processed by the agent's reasoning engine.
[COMMAND_EXECUTION]: The skill relies on executing multiple local Node.js scripts (including query.mjs, record.mjs, auth.mjs, and migrate-v3.mjs) via the agent's shell tool. These scripts handle arguments derived from user input and manage project metadata and authentication states.
[EXTERNAL_DOWNLOADS]: The skill documentation instructs the agent to install components using npx -y skills add campfirein/skills. While this involves downloading external code, the resource is hosted by the skill's official vendor and is a standard part of the tool's deployment lifecycle.

byterover