The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and executes instructions from an external file (.memplan/plan.mem).
Ingestion points: The skill retrieves plan steps and metadata from .memplan/plan.mem using the memplan-cli.js status command in Phase 1.
Boundary markers: There are no protective delimiters or instructions to the agent to treat the contents of the plan file as untrusted data.
Capability inventory: The skill possesses extensive capabilities, including the Bash, Write, Edit, and TaskUpdate tools, which are used to carry out the instructions found in the plan.
Sanitization: The skill does not implement any validation or sanitization of the step text before execution.
[COMMAND_EXECUTION]: The instructions direct the agent to construct shell commands by interpolating dynamic, potentially untrusted strings directly into command-line arguments.
Evidence: Phase 3 instructions include commands like node "$CLAUDE_PLUGIN_ROOT/bin/memplan-cli.js" progress . <M> <N> "<step-text>" and node "$CLAUDE_PLUGIN_ROOT/bin/memplan-cli.js" append . memory/entities.mem "entity" "name=<name>,type=<type>,desc=<description>".
Risk: If variables such as <step-text>, <name>, or <reason> contain shell metacharacters like backticks, semicolons, or unescaped double quotes, they could be exploited to execute arbitrary commands on the host system.

act