The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes 'persistent memory' and 'durable knowledge notes' while also reading configuration and rule files from the local filesystem.
Ingestion points: Persistent memory logs, durable knowledge notes, and local files such as .agents/rules/cog.md and sub-agent markdown files.
Boundary markers: No specific delimiters or 'ignore' instructions are present to separate data from commands when processing these sources.
Capability inventory: The skill uses invoke_subagent to execute tasks based on the contents of these files.
Sanitization: There is no evidence of sanitization, validation, or filtering of the content retrieved from memory or the filesystem.
[PROMPT_INJECTION]: The instructions use strong imperative language, such as 'execute it exactly as written' and 'authoritative playbook,' which are patterns often associated with attempts to override default agent constraints or force specific execution paths.
[COMMAND_EXECUTION]: The skill defines a dynamic mapping ('Antigravity substitution') that translates workers into invoke_subagent calls against filesystem paths, which could be exploited if an attacker can influence the naming of workers in the processed memory or notes.

memory-hygiene