The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted conversational data and interpolates it into persistent storage formats.
Ingestion points: The skill scans the current conversation (SKILL.md Step 1) to extract topics, code examples, and user-provided rules/misconceptions.
Boundary markers: There are no explicit instructions to wrap user-provided content in delimiters or to use "ignore embedded instructions" warnings in the generated notes or memory observations.
Capability inventory: The skill utilizes a Write tool to save Markdown files to the notes/ directory and an MCP memory tool (mcp__plugin_everything-claude-code-ios_memory__add_observations) to store persistent observations.
Sanitization: The skill lacks instructions to escape or sanitize content extracted from the conversation before writing it to the filesystem or memory, which could allow malicious instructions in the conversation to influence future agent behavior when the notes are read or memory is retrieved.
[DATA_EXFILTRATION]: The skill generates file paths dynamically based on conversational topics (e.g., notes/YYYY-MM-DD-<topic-in-english>.md).
Path Traversal Risk: If the <topic> is derived directly from untrusted user input without sanitization, it could be used to attempt path traversal (e.g., using ../ sequences), although the execution environment's tool safety constraints are expected to be the primary defense.

study-summary