The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user input and task context to build a longitudinal behavioral corpus, creating a surface for indirect injection if malicious instructions are stored and later recalled.
Ingestion points: Untrusted data enters the agent context through the raw_input field in the memory_recall and memory_record tool definitions found in scripts/mcp_server.py and processed in scripts/memory.py.
Boundary markers: The skill instructions in SKILL.md and references/recall-and-apply.md explicitly define memory as advisory data and untrusted advice, mandating that current user instructions and tool checks take precedence.
Capability inventory: The skill's scripts are limited to managing a local SQLite database (behavior.sqlite3) and performing standard introspection for argument mapping; they lack network access or general file-system write capabilities.
Sanitization: A comprehensive redaction engine in scripts/memory.py utilizes regex patterns to filter out secrets (API keys, tokens, credentials) and tokenizes input into sanitized cues to prevent the storage of raw sensitive payloads.
[SAFE]: The skill follows security best practices by using os.chmod in scripts/memory.py to set restricted file permissions (0o600) on the database and its parent directory, ensuring the local memory store is not accessible to other users on the system.
[SAFE]: External links in references/research.md target reputable academic sources (arXiv) and recognized research repositories (GitHub), and are documented as design provenance rather than runtime dependencies.

nerd-memory