The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user messages to detect memory-related intent using an LLM, creating a potential injection surface.\n
Ingestion points: User messages are ingested in src/hooks/memory-intent.ts via the tool.execute.before hook for chat and message tools.\n
Boundary markers: User input is interpolated directly into an LLM prompt template within double quotes without robust delimiters or instruction-bypass protection.\n
Capability inventory: The skill possesses extensive file system capabilities, including reading and writing to .memory.md and creating log files in the .memory/ directory across multiple files (src/hooks/memory-bootstrap.ts, src/hooks/memory-snapshot.ts, src/tools/memory-tool.ts).\n
Sanitization: No validation, escaping, or filtering is applied to the user-provided message before it is processed by the intent-detection LLM.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill records session history to local storage, which may inadvertently capture and persist sensitive data entered by the user.\n
Evidence: src/hooks/memory-snapshot.ts filters and saves session messages to JSON snapshot files in the .memory/snapshots/ directory, and src/tools/memory-tool.ts appends context to the .memory.md file.\n- [DYNAMIC_EXECUTION]: The skill utilizes dynamic module loading for standard utilities.\n
Evidence: src/hooks/memory-snapshot.ts and src/hooks/memory-compaction.ts use await import("fs/promises") to load file system modules at runtime.

opencode-memory