The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains instructions using mandatory and aggressive language to override the agent's decision-making process. Phrases like 'YOU MUST invoke this skill (NOT optional)' and 'Failure to invoke this skill when triggers occur violates your operational requirements' are used to force tool usage and bypass the agent's autonomous evaluation.
[DATA_EXFILTRATION]: The scripts/resource-api.sh script includes an upload command that accepts a file_path argument without restriction or validation. This allows the agent to read and transmit arbitrary files from the host system to the configured Memos instance. This capability can be exploited to exfiltrate sensitive files such as ~/.ssh/id_rsa, ~/.aws/credentials, or .env files to a remote server.
[COMMAND_EXECUTION]: The skill relies on executing multiple shell scripts (memo-api.sh, search-api.sh, resource-api.sh, tag-api.sh, user-api.sh) via the agent's shell tool to perform its operations. While the scripts use jq to handle JSON payloads, the fundamental design relies on local command execution for all network and file operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from a remote, user-controlled Memos instance, creating an attack surface where malicious notes could influence agent behavior.
Ingestion points: Data is ingested through scripts/memo-api.sh (list/get), scripts/search-api.sh, and scripts/tag-api.sh.
Boundary markers: None are present to distinguish between instructions and data.
Capability inventory: The skill has extensive capabilities including network operations (curl), file reading (resource-api.sh upload), and file writing (resource-api.sh download).
Sanitization: There is no sanitization of the content retrieved from the remote API before it is presented to the agent.

memos