The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted text from user conversations to extract structured memories, entities, and relationships. This creates a surface for indirect prompt injection attacks where malicious content embedded in the input text could attempt to manipulate the extraction logic.
Ingestion points: The ExtractInput interface in SKILL.md accepts arrays of turns and recent_messages which contain arbitrary text from user interactions.
Boundary markers: The skill defines 16 extraction rules, including Rule 12 ('Instructions-as-memory require user's own wording') and requirements for verbatim evidence quotes, which serve as delimiters and constraints on the LLM's interpretation of the data.
Capability inventory: The skill uses curl for network requests to OpenRouter and writes extracted data to a local SQLite database. It also performs graph-based retrieval which can influence future agent context.
Sanitization: The instructions include routines for stripping markdown fences from LLM responses and explicitly mention sanitizing FTS5 queries by replacing special characters to prevent SQL injection or syntax errors.
[CREDENTIALS_UNSAFE]: The documentation instructs the agent to retrieve its OpenRouter API key by sourcing ~/.localrc. Accessing and sourcing general-purpose shell configuration files is a sensitive operation as these files frequently contain other sensitive environment variables or secrets unrelated to the skill's specific task.
[COMMAND_EXECUTION]: The skill documentation explicitly instructs the agent to execute shell commands, specifically using source for environment configuration and curl for interacting with the OpenRouter API for text processing.

llm-structured-extraction