The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from .claude/memory/permanent_memory.md, which contains summaries of previous interactions that could potentially harbor malicious instructions.
Ingestion points: The skill uses the Read and Glob tools to ingest content from the .claude/memory/ directory.
Boundary markers: Loaded content is enclosed in a formatted block labeled with a trust: file stamp, providing a clear distinction between memory and current session instructions.
Capability inventory: The skill is restricted to read-only tools (Read, Glob) and cannot write files, execute shell commands, or perform network operations.
Sanitization: It applies a 'dual-read' rule that strictly limits ingestion to headers and single summary lines, enforced by a hard cap of 200 tokens to prevent context injection attacks.

permanent-memory-loader