The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where the agent reads and acts upon the contents of a PROJECT.md file located at the repository root. This file serves as an ingestion point for untrusted data, as its content could be influenced by external actors (e.g., through a Pull Request or shared access to the repository).
Ingestion points: The agent is instructed to read PROJECT.md at the start of a session or whenever resuming work.
Boundary markers: The skill lacks explicit instructions or boundary markers to differentiate between the data in the project memory and the agent's own operational instructions, creating a risk that malicious text in the file could be misinterpreted as commands.
Capability inventory: While this skill primarily performs markdown file operations, it operates within an agent environment that typically possesses file system access, terminal execution, and other powerful tools.
Sanitization: There is no mention of sanitizing or validating the contents of the PROJECT.md file before the agent processes and summarizes its content.

project-memory