The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill utilizes a local workspace in ~/Clawic/data/friend/ to store and retrieve user-specific data, such as values, patterns, and life context. This data is derived from past interactions and is loaded into the agent's context at the start of each session, creating a vulnerability where a user could potentially store instructions in their 'profile' that the agent might later follow as rules.
Ingestion points: The skill reads ~/Clawic/data/friend/memory.md and other workspace files at session start to establish the persona's current memory and context.
Boundary markers: There are no instructions in the skill files to wrap the retrieved memory content in protective delimiters or to warn the agent to ignore any instructions found within that data.
Capability inventory: The skill is centered on conversational interaction and personality. It does not possess high-risk capabilities such as remote code execution, network exfiltration tools, or access to sensitive system directories (e.g., .ssh or .aws).
Sanitization: The skill does not implement any validation or sanitization logic to ensure that the data being read from the workspace files contains only descriptive information and no executable instructions.

Friend