The Agent Skills Directory

[COMMAND_EXECUTION]: The Node.js extension (extensions/people-memories/index.js) executes the Python CLI tool using execFile based on voice transcript matches. While execFile is generally safer than shell-based execution, it still facilitates the execution of local scripts based on untrusted transcript input.\n- [DATA_EXFILTRATION]: The export command in scripts/people_memory.py allows writing the contents of the people database to any file path provided by the user via the --out parameter. This capability could be used to overwrite critical system files or expose personal data to insecure locations if the agent is manipulated into specifying a malicious path.\n- [EXTERNAL_DOWNLOADS]: The Python script scripts/people_memory.py imports dateutil, an external package not part of the standard library. This contradicts the documentation in README.md, which states the skill has no external dependencies, and requires the installation of python-dateutil to function correctly.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it stores and displays unsanitized user notes. A malicious note stored in the database could contain instructions that redirect the agent's behavior when the note is later retrieved.\n
Ingestion points: Voice transcript capture in extensions/people-memories/index.js and the remember command in scripts/people_memory.py.\n
Boundary markers: Absent. Stored notes are output directly to the console in commands like recall, summarize, and search without markers to distinguish data from instructions.\n
Capability inventory: The skill possesses file writing and command execution capabilities through its Python script and Node.js extension.\n
Sanitization: None. Notes are stored and printed exactly as received, providing no defense against embedded malicious instructions.

people-memories