The Agent Skills Directory

[PERSISTENCE]: The skill instructs agents to save 'lessons' and 'scripts' in the user's home directory (~/.agents/scripts/, ~/.agents/memory/). These files are intended to be read and acted upon by future agent sessions, creating a persistence mechanism that functions across different projects and environments.
[DYNAMIC_EXECUTION]: The references/scripts.md file defines a workflow where agents write executable scripts to disk and subsequently execute them with arguments. This pattern of autonomous code generation and execution represents a significant security risk as it bypasses static instruction boundaries.
[INDIRECT_PROMPT_INJECTION]: The skill's architecture is vulnerable to indirect prompt injection because agents are instructed to 'recall' and follow instructions found in AGENTS.md and other project files. 1. Ingestion points: AGENTS.md, .agents/scripts/INDEX.md, ~/.agents/scripts/INDEX.md, and various project documents (glossary.md, conventions.md). 2. Boundary markers: Absent; there is no isolation between untrusted 'memorized' data and the agent's core system instructions. 3. Capability inventory: The skill facilitates file writing, shell command execution (running generated scripts), and network operations (opening URLs in browser via wizards). 4. Sanitization: Absent; there is no evidence of validation or sanitization for the content being 'memorized' or 'recalled.'
[COMMAND_EXECUTION]: The 'Wizard' functionality (references/wizard.md and assets/template.sh) encourages the creation of scripts that perform sensitive operations, such as modifying .env files and using the GitHub CLI (gh secret set) to manage repository secrets.

memorize