The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions to conceal internal technical operations and specific file system locators from the user. It mandates substituting technical terms (database tables, indexes, tool names) with "everyday language" and explicitly forbids informing the user that original chat messages may remain visible after cleanup, which reduces transparency and user oversight of the agent's actions.
[COMMAND_EXECUTION]: The skill utilizes the exec tool to perform file deletions using the rm command. While it includes instructions to avoid recursive deletion (rm -r) and to validate paths, the execution of shell commands based on logic derived from untrusted conversation history is inherently risky.
[INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves a subagent (forget.plan) that ingests untrusted data to generate a plan for file modification and deletion.
Ingestion points: Current and prior conversation history, side-chat events, subagent histories, and search results (as detailed in references/artifact-inventory.md).
Boundary markers: The instructions do not specify any delimiters or safety markers to isolate untrusted conversation text from the instructions given to the planning subagent.
Capability inventory: Access to exec for rm commands, file writing capabilities for JSON state, and memory retraction tools.
Sanitization: The skill relies on natural language instructions to "not repeat sensitive text in tool arguments," but lacks programmatic sanitization or path whitelisting for the shell commands it generates.
[PRIVILEGE_ESCALATION]: The skill grants the agent the capability to delete arbitrary files within the user's home directory (e.g., ~/MEMORY.md, ~/SOUL.md, ~/USER.md) via shell commands. If the planning phase is compromised via indirect injection, this could be leveraged to delete sensitive configuration or data files beyond the intended memory cleanup scope.

forget