The Agent Skills Directory

Filesystem Interaction and Persistence: The skill enables persistent storage across agent sessions and allows the agent to interact with the local filesystem through tools like read_file and write_file. While this is the intended functionality for agent memory, it involves direct disk access. The documentation mitigates potential risks by recommending the use of virtual_mode=True to prevent directory traversal and interrupt_on settings to require human approval for file modifications.
Indirect Prompt Injection Surface: The inclusion of tools for reading filesystem content (read_file, grep, glob) creates a surface where the agent could ingest data containing hidden or adversarial instructions. This represents a potential indirect prompt injection vector if the files being processed originate from untrusted external sources.
Ingestion points: File reading and searching tools such as read_file, grep, and glob (documented in SKILL.md).
Boundary markers: The documentation does not specify the use of delimiters or specific instructions for the agent to ignore embedded commands within processed files.
Capability inventory: The agent possesses writing capabilities (write_file, edit_file) which could be misused if an injection attack is successful.
Sanitization: The skill emphasizes path-level security via virtual_mode but does not detail sanitization or validation of the content read from files.

deep-agents-memory