The Agent Skills Directory

[PROMPT_INJECTION]: The skill employs strong, imperative language designed to override the agent's default operational behavior. Phrasing such as 'The Prime Directive', 'No exceptions. No workarounds. No shortcuts', and 'No excuses' are used to ensure the agent follows the 'knowledge capture' protocol regardless of context or prior instructions.
[PERSISTENCE]: The skill's primary function is to maintain state across sessions by writing to files in ~/.claude/projects/[project]/memory/. Furthermore, it explicitly instructs the agent to promote 'convictions' to rules within the CLAUDE.md file, which is a project-level configuration file used to define the agent's behavior and constraints for all future interactions.
[INDIRECT_PROMPT_INJECTION]: The skill creates a feedback loop where data processed during a session is 'distilled' and saved to disk, then read back into the agent's context at the start of subsequent sessions. This establishes an attack surface where malicious instructions could be embedded in 'lessons' or 'insights' to achieve persistence in the agent's system prompt.
Ingestion points: The agent is instructed to read all memory files in ~/.claude/projects/[project]/memory/ and CLAUDE.md at the start of every session.
Boundary markers: There are no specified boundary markers or delimiters to differentiate between safe instructions and potentially malicious content stored in the memory markdown files.
Capability inventory: The skill utilizes the agent's core capabilities to read from and write to the local file system.
Sanitization: The protocol lacks any sanitization or validation of the 'insights' before they are saved or re-read, meaning instructions retrieved from memory are treated as authoritative context.

knowledge-capture