The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves reading from and writing to a persistent knowledge store (Brand Brain or local markdown files), which can serve as a vector for indirect prompt injection if an entry contains malicious instructions.
Ingestion points: The skill reads data from external sources using the brand_knowledge_read, brand_knowledge_search, and brand_read tools, and also ingests content from brand-notes.md in local mode.
Boundary markers: The skill does not specify the use of delimiters or safety instructions when reading previously saved data to distinguish rules from active agent instructions.
Capability inventory: The skill has the ability to modify the knowledge base via brand_knowledge_save and brand_update, and can perform local file system writes (appending to brand-notes.md).
Sanitization: The skill enforces a strict 300-character limit for all saved entries, which significantly limits the complexity and effectiveness of potential injection payloads.

save-learning