The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted conversation data (last 50 turns) and persists it as markdown, creating a surface for indirect prompt injection where malicious instructions in one conversation could influence future sessions.
Ingestion points: Conversation history and previously stored memory files (INDEX.md and entries/).
Boundary markers: The skill does not explicitly use delimiters or "ignore instructions" warnings when loading memory into context.
Capability inventory: The skill has extensive file system capabilities, including reading, writing, moving (archiving), and deleting files across three storage tiers.
Sanitization: Mitigations include a mandatory consent preview showing a diff of planned changes, a privacy pre-flight check that refuses sensitive data, and a confidence-scoring system that rejects model inferences by default.
[EXTERNAL_DOWNLOADS]: The documentation includes instructions for users to install the @lorekit/cli tool via npx to enable advanced scaling features. This involves downloading and executing code from a remote registry.
[DATA_EXFILTRATION]: The skill accesses potentially sensitive file paths such as ~/.agent-memory/ and project-local .agent/ directories. However, this access is fundamental to its purpose of context persistence, and it explicitly refuses to store credentials or secrets detected in the environment or conversation.

persistent-memory