The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to instructions embedded within the markdown files it processes, which could override its maintenance logic.
Ingestion points: Untrusted markdown files in raw/inbox/* and existing files within the knowledge base directory are ingested into the agent's context.
Boundary markers: Absent. There are no instructions to delimit external content or treat it as passive data rather than active instructions.
Capability inventory: The skill has broad file system access (read, write, delete) and network access. It can delete files via the forget or pruning logic and update the MEMORY.md index.
Sanitization: Absent. The skill does not escape or validate the content of the notes before processing or indexing them.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to URLs found in the sources: field of markdown notes. If a malicious note is ingested, it can trigger the agent to visit attacker-controlled URLs under the guise of refreshing content.

dream