The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context injection syntax (!) in SKILL.md to execute scripts/resolve.py at skill load time. This script determines the appropriate directory for memory storage by querying environment variables and the filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and 'apply' content from local memory files (MEMORY.md and linked topic files). This creates a surface for indirect prompt injection if an attacker or a malicious process modifies these files to include instructions disguised as project history or facts.
Ingestion points: The agent reads MEMORY.md, ARCHIVE.md, and various kebab-case topic files (.md) from the project's memory directory.
Boundary markers: None. The instructions do not provide delimiters or warnings to treat the memory content as untrusted data.
Capability inventory: The skill possesses file read/write capabilities and the ability to execute shell commands (git) via a sub-process.
Sanitization: None. Content from the markdown files is treated as a 'statement of current truth' to be applied to the current task.
[COMMAND_EXECUTION]: The scripts/resolve.py script executes git commands using subprocess.run. The implementation is secure as it uses list-based arguments rather than a shell string, preventing typical command injection vulnerabilities.

use-project-memory