The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides complex shell scripts intended for the agent to execute. These scripts manage file system operations such as creating symlinks (ln -s), modifying configuration files (sed, grep, tee), and executing an external AI tool (codex exec). While functional for the stated migration purpose, these represent significant local execution capabilities that should be monitored.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading and classifying "memory" files from ~/.claude/projects/*/memory/. These files, which contain past user interactions and feedback, act as an ingestion point for untrusted data. If these historical logs contain malicious instructions, they could influence the agent's behavior during the migration process.
Ingestion points: ~/.claude/projects/*/memory/ (documented in SKILL.md and references/diagnosis_and_scoping.md).
Boundary markers: Absent. The skill does not instruct the agent to use specific delimiters or ignore embedded instructions when reading memory content.
Capability inventory: File read/write, directory creation (mkdir), and shell command execution via find, grep, sed, ln, rm, and codex exec (documented in references/review_and_verification.md and references/tool_agnostic_migration.md).
Sanitization: Absent. The skill relies on multi-agent review to verify migration accuracy but provides no mechanisms to filter or sanitize the content of the memory files being processed.
[METADATA_POISONING]: The skill includes a file titled .security-scan-passed which claims the skill has passed various security scans (gitleaks, pattern-based validation). This is a self-referential safety attestation that attempts to influence the judgment of security analyzers and should not be considered authoritative.
[PERSISTENCE]: The skill implements persistent changes to the user's environment to maintain its tool-agnostic architecture. It modifies the local ~/.codex/config.toml to increase document processing limits and creates a persistent symlink ~/.codex/AGENTS.md pointing to ~/.claude/CLAUDE.md, ensuring its configurations remain active across sessions.

claude-migrate-memory-to-doc