The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of historical session data into the agent's active prompt, creating a vector for indirect instructions to persist across sessions.
Ingestion points: The build_memory_context function in SKILL.md retrieves entities and summaries from the MemoryStore (Cloudflare KV) and interpolates them into a string returned for context assembly.
Boundary markers: The skill uses XML-style tags like <prior_knowledge> and <recent_sessions> to delimit retrieved data. However, it lacks explicit instructions telling the model to ignore any embedded commands within these blocks.
Capability inventory: The skill enables long-term data persistence and retrieval, effectively allowing data from one session to dictate the context of all future sessions for a given user.
Sanitization: The implementation does not include any sanitization, filtering, or escaping of the entity.content or s.content fields before they are injected into the prompt, meaning malicious instructions stored in memory will be executed by the LLM as part of the context.

memory-persistence