The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches metadata from the GitHub API and downloads binary archives from an external repository at github.com/mnemon-dev/mnemon.
[REMOTE_CODE_EXECUTION]: A binary file (mnemon) is downloaded, extracted into a system path (/usr/local/bin), and subsequently executed during the agent container's initialization process via entrypoint.sh.
[COMMAND_EXECUTION]: The skill executes shell commands to interact with host-level service managers, specifically systemctl --user restart and launchctl kickstart, to apply changes.
[PERSISTENCE]: Modifies the container/entrypoint.sh script to ensure that the mnemon setup command is executed every time the container starts, effectively establishing a persistent execution hook.
[PRIVILEGE_ESCALATION]: Installs a binary into a root-owned system directory (/usr/local/bin) and attempts to restart system services on the host environment.
[INDIRECT_PROMPT_INJECTION]: Implements a persistent memory system that stores and later injects data from previous sessions into the agent's current context, creating a potential surface for injection via past malicious inputs.
Ingestion points: Retrieves context from graph-based memory stored in the .claude/mnemon directory (referenced in SKILL.md).
Boundary markers: The provided scripts do not show explicit delimiters or warnings to the agent that the injected context originates from potentially untrusted past interactions.
Capability inventory: The skill includes capabilities for system binary installation, shell script modification (entrypoint.sh), and host service management.
Sanitization: There is no evidence of sanitization or validation of the memory content before it is surfaced to the agent.

add-mnemon