The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill systematically extracts entities from conversation history and persists them in remote storage to be re-injected into the agent's context in future sessions. This creates a feedback loop where malicious instructions embedded in a user's conversation could be stored as an 'entity' and executed by the agent when retrieved later.
Ingestion points: The EXTRACTION_PROMPT in SKILL.md ingests the {conversation} variable, which contains untrusted user input.
Boundary markers: While the prompt uses a JSON schema and labels, it lacks explicit instructions to ignore or escape instructions embedded within the conversation data itself.
Capability inventory: The skill implements the upsert and updateIndex methods to write data to Cloudflare KV, and retrieveForContext to pull that data back into the agent's operational context.
Sanitization: The assemble_entity_context function in SKILL.md interpolates stored content and name fields directly into a markdown string (- **{item['name']}**: {item['content']}) without escaping or validation, allowing stored injection payloads to be interpreted as instructions in future sessions.

entity-memory-management