The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to load and process session context, checkpoints, and project memories, which represents a vulnerability surface where instructions embedded in project files could influence the agent's behavior.
Ingestion points: The skill ingests data via tools such as Read, read_memory, and list_memories, targeting files in directories like **/.claude/**, **/sessions/**, and **/tasks/** as defined in the skill's file patterns.
Boundary markers: The reference documentation does not specify the use of clear delimiters or instructions to ignore embedded prompts within the ingested session data.
Capability inventory: The skill has access to tools that can modify state, including Write for saving context, TodoWrite for task tracking, write_memory for persistence, and activate_project for environment setup.
Sanitization: There is no evidence of validation or sanitization of the content retrieved from external files before it is integrated into the active session context.

session-management