The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands like cat, mkdir, and echo to manage memory banks and project configuration. It specifically targets files such as AGENTS.md, CLAUDE.md, and .github/copilot-instructions.md.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it reads content from external files and uses it to guide agent behavior without validation or boundary markers.
Ingestion points: The skill loads data from AGENTS.md, .github/copilot-instructions.md, and global user files like ~/.copilot/copilot-instructions.md (SKILL.md).
Boundary markers: Absent; file content is interpolated directly into the instructions and reportage, creating a surface where malicious file content could influence agent actions.
Capability inventory: The skill has the ability to write files, create directories, and perform shell command execution based on the loaded context (SKILL.md).
Sanitization: Absent; the skill does not verify or sanitize the content of the markdown files it processes before displaying or using them (SKILL.md).
[DATA_EXFILTRATION]: Accesses the global user configuration file ~/.copilot/copilot-instructions.md. While the skill's instructions explicitly warn against storing secrets like API keys or passwords, this path allows reading data from outside the current project directory.

always-on-memory