The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection because it automatically extracts and injects user-provided content (rules and memories) directly into the system prompt.
Ingestion points: Content is ingested through memory::save, memory::rule::set, and automatic extraction from session turns into the learned rule.
Boundary markers: The skill describes rules as being "injected whole into the system prompt," indicating a lack of robust structural boundaries between stored memory and system instructions.
Capability inventory: The skill performs file writes to local storage (banks/rules) and modifies the agent's prompt context dynamically.
Sanitization: No explicit sanitization or filtering of stored content is mentioned before it is re-injected into the prompt. While this presents an injection surface, it is consistent with the primary purpose of a memory-management skill.
[SAFE]: The skill does not attempt to access sensitive system files (e.g., SSH keys, cloud credentials) or perform unauthorized network operations. All file access is scoped to the memory banks (e.g., rules/ folder and .trash/). No obfuscation or remote code execution patterns were detected.

memory