The Agent Skills Directory

[DATA_EXFILTRATION]: The skill's core script scripts/memory_sync.py reads sensitive files including AGENTS.md, SOUL.md, USER.md, and TOOLS.md. These files often contain the agent's core identity, behavioral constraints, and potentially user-sensitive information. The skill provides built-in functionality to push these files to a remote repository via the --remote and --push flags. This creates a high-risk data exfiltration pathway if the agent is manipulated into specifying an attacker-controlled Git remote.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute Git commands such as init, add, commit, remote, and push. Several parameters for these commands—including the commit message (--message), the branch name (--branch), and the remote URL (--remote)—are taken directly from command-line arguments. While shell=True is not used, providing arbitrary strings to system binaries like git can lead to unintended execution behavior or command injection vulnerabilities if the agent is coerced into using specially crafted inputs.
[PROMPT_INJECTION]: The skill contains a vulnerability surface for indirect prompt injection because it processes and moves data from the workspace's memory directories without sanitization.
Ingestion points: The script scripts/memory_sync.py reads and copies all files within the memory/ directory and specific core documents from the workspace root.
Boundary markers: Absent. The files are copied verbatim without delimiters or warnings to the agent that the content may contain untrusted instructions.
Capability inventory: The skill possesses both file system write capabilities (shutil.copy2, shutil.copytree) and network transmission capabilities (git push).
Sanitization: Absent. There is no validation or filtering of the content being archived, allowing malicious instructions embedded in memory logs to persist and potentially influence future agent sessions upon restoration.

memory-keeper