The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The system functions by retrieving and reasoning over 'experiences' stored in a vector database. This creates a surface for indirect prompt injection where malicious content in processed data could override agent behavior during retrieval steps.
Ingestion points: The adapter.insertPattern and adapter.train methods (referenced in SKILL.md and several example files) ingest external data into the agent's persistent memory.
Boundary markers: While the documentation mentions sanitizing metadata, no explicit markers or instruction delimiters are shown for separating retrieved context from system instructions in the provided snippets.
Capability inventory: The skill specifies access to tools such as Bash, Write, Edit, and WebFetch in its YAML frontmatter, which could be exploited if an injection is successful.
Sanitization: General instructions for sanitizing metadata to prevent injection attacks are included in the 'Guardrails & Safety' section.
[REMOTE_CODE_EXECUTION]: The documentation provides instructions for executing code via npx agentdb@latest, which dynamically downloads and executes packages from the public NPM registry at runtime.
[COMMAND_EXECUTION]: The benchmarking script resources/scripts/benchmark_9algorithms.sh executes shell commands and local Python scripts, enabling the skill to run arbitrary logic and perform file operations on the host system.
[DATA_EXFILTRATION]: The 'LIBRARY-FIRST PROTOCOL' in SKILL.md instructs the agent to check and extract data from the local path D:\Projects\*. This represents a data exposure risk as it could inadvertently bring sensitive local files into the model's context.
[EXTERNAL_DOWNLOADS]: The skill depends on external packages such as agentic-flow and agentdb fetched from public registries, which may pose a supply chain risk if the sources are not strictly verified.

agentdb-learning-plugins