The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill stores user-provided decisions and context in local files and later reads this content back into the agent's instructions, creating a surface for indirect prompt injection where malicious instructions could be saved and subsequently followed by the agent.
Ingestion points: ~/.claude-memories/index.json and associated markdown files in the decisions/, blockers/, context/, preferences/, procedures/, and notes/ subdirectories.
Boundary markers: Absent; the skill does not use delimiters or warnings to separate recalled data from instructions.
Capability inventory: The skill uses shell commands for reading (cat), copying (cp), and deleting (find ... -delete) memory files.
Sanitization: No sanitization or validation of user-provided content is performed before storage or retrieval.
[COMMAND_EXECUTION]: The skill workflow relies on the execution of shell commands for indexing and managing memory files. While these commands are used for legitimate functionality, the capability to read and delete files could be misused if the agent is compromised via prompt injection. Evidence includes commands for index management (cat ~/.claude-memories/index.json) and backup rotation (find ~/.claude-memories/backups/ -name "index-*.json" -mtime +30 -delete).

context-manager