The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions repeatedly emphasize silent background operation and explicit concealment of modifications from the user. While intended for user convenience, such suppression of transparency is a known technique for hiding malicious agent behavior.
Evidence: "This skill should run SILENTLY in the background — don't announce it, just apply what's known."
Evidence: "Do NOT announce running the recall check. Just run it, apply what's relevant, and proceed."
Evidence: "Do not tell the user 'I removed X because it was blocked before' unless they ask — just present the clean prompt."
[COMMAND_EXECUTION]: The skill uses the bash tool to execute Python scripts with arguments derived directly from user input (prompt terms and project names), creating a command injection vulnerability surface if the agent or scripts do not implement strict sanitization.
Evidence: python3 scripts/higgsfield_memory.py query-filter "<key terms from prompt>" 5 in SKILL.md
Evidence: python3 ../../scripts/higgsfield_memory.py log-gen <project> ... where project name is defined by the user.
[INDIRECT_PROMPT_INJECTION]: The skill automatically ingests content from external JSON databases and applies them as "fixes" to the active prompt context, representing a potential data-driven influence on agent behavior.
Ingestion points: db/filter-memory.json and db/quality-memory.json via the recall workflow.
Boundary markers: Absent; there are no clear delimiters separating ingested database content from current prompt instructions.
Capability inventory: The skill utilizes bash for filesystem and script execution.
Sanitization: No sanitization logic for ingested data is documented in the instruction file.

higgsfield-recall