The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple sources including past conversation history, team-shared memories, and external skills discovered via search tools.
Ingestion points: The skill retrieves data through memory_search, memory_get, skill_get, and network_memory_detail (SKILL.md).
Boundary markers: There are no explicit instructions or delimiters defined to isolate retrieved memory content from the agent's control instructions.
Capability inventory: The agent has capabilities to write to shared memory (memory_write_public), install new skills (skill_install), and communicate with a team server.
Sanitization: There is no evidence of input validation or sanitization for content retrieved from the memory database or team hub.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of the better-sqlite3 Node.js package and provides tools to pull skill bundles from a remote team server.
Evidence: The metadata specifies kind: node, package: better-sqlite3 for installation. The tool network_skill_pull is designed to download content from a remote server.
[DYNAMIC_EXECUTION]: The skill_install tool allows the agent to load and permanently enable new capabilities in its workspace, which involves the dynamic loading of instructions or executable logic.
Evidence: The instruction for skill_install states it installs a skill so it "becomes permanently available" and will be "loaded automatically in future sessions."
[DATA_EXFILTRATION]: The skill includes functionality to transmit local conversation data and tasks to a remote hub or team server.
Evidence: Tools like memory_share, task_share, and skill_publish support a target='hub' parameter to send data externally. While the instructions mandate explicit user consent, the functional capability for data transmission is present.

memos-memory-guide