The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements a persistence mechanism that reads architectural details from the codebase and stores them in a local project memory directory. This data is subsequently loaded into the context of other agents and subagents. Maliciously crafted content within the codebase being mapped or within the stored memory files could potentially influence agent behavior in future sessions.
Ingestion points: The orchestrator and subagents read configuration and map data from ~/.claude/projects/<project-hash>/memory/cartographer/ (including map.md, conventions.md, landmines.md, and modules/*.md).
Boundary markers: The skill lacks explicit LLM-level boundary markers or "ignore embedded instructions" warnings when interpolating these memory files into subagent dispatches.
Capability inventory: The skill possesses the capability to read and write files within the project directory and dispatch Sonnet subagents with potentially poisoned context.
Sanitization: The skill relies on the 'Cartographer Recorder' subagent to semantically distill information and filter for 'FACTS', which provides a layer of interpretation but does not fully mitigate adversarial injection.

cartographer-skill