The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves retrieving past memories and injecting them directly into the agent's system prompt via the memstack context command. This creates a significant surface for indirect prompt injection.
Ingestion points: Memories are retrieved from storage backends (disk, Postgres, Redis, etc.) using memstack retrieve and memstack context. These memories often consist of raw user interactions or observations from external sources.
Boundary markers: The skill documentation shows memories being prepended to the system prompt (SYSTEM_PROMPT=$(echo "$CONTEXT" | jq -r '.systemPrompt')) without explicit mention of sanitization or delimiters to prevent the agent from following instructions embedded within those memories.
Capability inventory: The skill executes shell commands (npm install, memstack store/retrieve/context), manages file system paths (MEMSTACK_DIR, SQLITE_PATH), and interacts with network-connected databases (DATABASE_URL, REDIS_URL).
Sanitization: There is no evidence in the instructions or command reference of sanitization or filtering of memory content before it is injected into the LLM context.
[COMMAND_EXECUTION]: The skill requires the installation and execution of a global NPM package (@memstack/cli). It uses shell command patterns to manage data, including memstack context, memstack store, and memstack summarize.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to install a third-party package from the NPM registry (npm install -g @memstack/cli). While @memstack/cli appears to be a tool provided by the author 'isiomac', users should ensure the package is legitimate before installation.
[CREDENTIALS_UNSAFE]: The skill requires sensitive environment variables to be set, specifically OPENAI_API_KEY, ANTHROPIC_API_KEY, and DATABASE_URL. While the documentation follows best practices by suggesting these be stored in environment variables rather than hardcoded, the handling of these secrets by the external CLI tool represents a point of trust.

memstack-cli