The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill captures patterns and evidence from user conversations and stores them in local JSONL files (~/.smtm/projects/{slug}/learnings.jsonl). These stored insights are automatically retrieved and interpolated into the system prompts of all other skills in the money-* ecosystem. This mechanism allows data from past interactions to influence the agent's logic in future sessions, which could be exploited to persist malicious instructions.
Ingestion points: Data is ingested from conversation history and stored in the learnings.jsonl files located in the ~/.smtm/ directory, as described in the schema and workflow sections of SKILL.md.
Boundary markers: While the skill uses a preamble (e.g., '📚 Loaded 4 relevant learnings...') to identify injected content, it lacks technical delimiters or instructions for the agent to treat the loaded data as untrusted, increasing the risk that the agent might follow instructions embedded within a learning.
Capability inventory: The skill performs local file read/write operations within the user's home directory (~/.smtm/) and possesses the capability to modify the operating context for a wide range of other agent skills.
Sanitization: The skill incorporates manual verification steps, such as the interactive extraction process in /money-learn add and the cleanup process in /money-learn prune, which provide opportunities for the user or agent to filter out inappropriate or malicious content before it is committed to the long-term memory file.

money-learn