The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which can contain malicious instructions intended to manipulate the agent's output.
Ingestion points: The skill reads external data from git logs, pull request bodies, issue trackers (Jira, Linear, GitHub), and conversation transcripts as described in SKILL.md (Step 3).
Boundary markers: The skill lacks explicit delimiters or structural markers to isolate external data from its own instructions during the synthesis process.
Capability inventory: The skill has the capability to write to the local file system (team-memory/MEMORY.md) and execute shell commands to commit changes to the repository (git add, git commit).
Sanitization: The skill includes specific instructions for a "PII and scope filter" in SKILL.md (Step 0) to remove personal identifiers and sensitive chat content.
[DATA_EXFILTRATION]: The skill reads project configuration and conversation history to generate a shared file that is committed to the repository, potentially leading to accidental exposure of sensitive project context.
The skill reads configuration files from .claude/ directories and CLAUDE.md files (Step 0.5).
The skill aggregates in-session conversation history, which may inadvertently contain sensitive technical details or internal communications, and persists them into a git-tracked file (team-memory/MEMORY.md).
[COMMAND_EXECUTION]: The skill executes shell commands to discover files and aggregate history.
Evidence: Uses find to locate configuration and memory files across the repository (Step 0.5).
Evidence: Uses git log and gh pr list to gather project activity (Step 3).
Evidence: Uses git add and git commit to persist the generated memory file (Step 6).

team-memory