The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read, curate, and act upon files located in .claude/agent-memory/**, which are authored by other agents. This creates a surface where malicious or misleading content in those notes could influence the agent's behavior during the curation phase.
Ingestion points: Files within the .claude/agent-memory/ directory across multiple scopes in the repository.
Boundary markers: The instructions do not prescribe the use of delimiters or specific 'ignore' instructions when the agent is processing the content of these memory files.
Capability inventory: The agent is authorized to perform git operations (ls-files, stage, commit), file system discovery (find), network queries via the GitHub CLI (gh pr view), and execute formatting tools (oxfmt).
Sanitization: There is no explicit requirement to sanitize or validate parameters like PR numbers or repository names extracted from the notes before they are used in shell commands such as the GitHub CLI.
[COMMAND_EXECUTION]: The skill relies on several shell commands for repository discovery and maintenance.
Evidence: Uses git rev-parse, git ls-files, find, sed, sort, and git check-ignore to manage file scopes and policies.
Evidence: Instructs the agent to execute project-specific formatters such as oxfmt on the repository content.
[DATA_EXFILTRATION]: While the skill's primary goal is to curate and prune notes to prevent the exposure of stale or incorrect information, it establishes a workflow for committing agent-generated notes to version control. If the curation process fails to identify sensitive data (e.g., internal paths or discovered vulnerabilities mentioned in notes), that data may be committed and thus exfiltrated to the remote repository.
Evidence: The 'STEP 2' curation process is a manual-judgment step for the agent, which may be incomplete as noted in the 'Scale check' section.

managing-agent-memory