The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs several shell scripts (start_session.sh, append_capture.sh, bootstrap_memory.sh, etc.) to automate project knowledge management. These scripts use standard local utilities such as awk, sed, mkdir, and printf to create and update markdown files within the project-memory/ directory. No patterns of arbitrary command injection or execution of untrusted remote scripts were found.
[EXTERNAL_DOWNLOADS]: The documentation (references/qmd-integration.md) recommends the installation of the qmd search tool (@tobilu/qmd) via a package manager. The skill's scripts do not perform automated downloads or installations; they only check for the presence of the tool on the local system path to provide indexing features.
[PROMPT_INJECTION]: The skill instructions facilitate the organization of project logs and the retrieval of past lessons. While the agent is instructed to read and summarize project-local markdown files—which could theoretically serve as a surface for indirect prompt injection if malicious content is committed to the repository—the workflows are designed for internal project use and emphasize user review for final memory saves.

project-memory