The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes historical conversation data stored in a local SQLite database, which is then injected into the agent's context.
Ingestion points: Historical messages are fetched via recent_chats.py and search_conversations.py and rendered as markdown for the agent's consumption.
Boundary markers: While the output uses markdown headers and bold role markers (e.g., **User:**), it lacks explicit instructions or unique delimiters to prevent the agent from following malicious instructions potentially embedded in the recalled history.
Capability inventory: The skill context allows execution of Bash(python3:*), Read, Grep, Glob, and Agent tools, which could be leveraged if the agent inadvertently follows instructions from the recalled text.
Sanitization: The skill performs search term sanitization for SQL safety but does not filter or sanitize the actual content of the retrieved messages for prompt injection patterns.

recall-conversations