The Agent Skills Directory

[COMMAND_EXECUTION]: The Python script _apply_forge_inner.py performs sensitive file system operations, including recursive deletion (shutil.rmtree) and file creation, using paths constructed from the name and source_skill parameters provided in an LLM-generated YAML block. The script fails to validate or normalize these paths; if they contain absolute paths or directory traversal sequences (e.g., ..), the script could be coerced into deleting or overwriting files outside the intended project skill directories.
[REMOTE_CODE_EXECUTION]: The skill facilitates the automated installation of new agent-loadable code. This capability allows for a 'delayed' remote code execution or persistence attack. If the forge process is subverted by malicious input files, an attacker could plant 'backdoored' skills that execute in future agent sessions.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted 'lesson-learned' files from the project-memory/ directory to drive its curation logic. Maliciously crafted content in these files could influence the LLM during the 'forge' pass to perform destructive actions, such as deleting legitimate skills or creating malicious ones.
Ingestion points: Reads files matching project-memory/lesson-learned/*/session-*.md.
Boundary markers: None observed. The instructions do not provide explicit delimiters or warnings to ignore embedded instructions in the source data.
Capability inventory: Significant file system access including the ability to write new SKILL.md files, append to references, and delete directories in several standard skill-loading locations.
Sanitization: No sanitization or validation is performed on the LLM's structured YAML output before it is processed by the execution scripts.

memory-forge