The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data which could lead to indirect prompt injection.
Ingestion points: Data enters the context through files like CLAUDE.md, MEMORY.md, and memory/*.md, as well as git log output and the session history database at ~/.claude-memory/conversations.db (Phase 1).
Boundary markers: The skill does not employ explicit delimiters or 'ignore' instructions when providing this external data to the Memory Auditor and Signal Discoverer subagents.
Capability inventory: The skill possesses the ability to Write and Edit files, and use Bash to run python3, git, find, and trash (Phases 1, 2, and 4).
Sanitization: There is no evidence of content sanitization or filtering before the data is processed by the agent.
Mitigation: The risk is mitigated by a mandatory human review step (AskUserQuestion) before any proposed memory updates are committed to the file system.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform several system-level tasks.
It executes find to locate memory directories across the home folder.
It runs git log to extract recent development context from the repository.
It uses python3 to query the local SQLite database containing conversation history at ~/.claude-memory/conversations.db.
It uses trash to remove retired memory files, providing a reversible method for cleaning up stale information.

extract-learnings