The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes memory files that could contain instructions or malicious content injected during previous sessions when the agent was interacting with untrusted external data.
Ingestion points: The skill scans and reads all files within ~/.claude/projects/{slug}/memory/ (documented in SKILL.md under Workflow steps 1 and 2).
Boundary markers: No specific delimiters or instructions to ignore embedded commands are specified when reading the memory files.
Capability inventory: The skill uses Read, Write, Edit, Glob, Grep, and Bash tools to manage the filesystem and execute promotions.
Sanitization: There is no mention of sanitizing, escaping, or validating the content of the memory files before they are processed and potentially promoted to global configuration files.

promote-memory