The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/post_tool_capture.py to call internal scripts for memory management. This is a standard implementation for local tool hooks and uses list-based arguments which prevents shell injection.
[PROMPT_INJECTION]: The skill ingests and stores output from other tools (such as bash results or file edits) as 'memories'. This creates an indirect prompt injection surface where malicious data encountered during a session could be re-injected into the agent's context in a future session when memory is recalled.
Ingestion points: The scripts/post_tool_capture.py script reads tool outputs and inputs from sys.stdin to process and store them in the memory database.
Boundary markers: Absent; the content is stored and retrieved as raw text without explicit markers to separate memory content from agent instructions.
Capability inventory: The system allows storing and searching observations; retrieved memories are presented to the agent to influence its behavior in subsequent sessions.
Sanitization: Content is truncated to 300 characters before storage, but no further sanitization or escaping of potentially malicious instructions is performed.

cowork-mem