The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process stored memories and notes which represent a potential attack surface for indirect prompt injection.
Ingestion points: Uses the memory_read tool and the grep command via exec on the groups/ directory in SKILL.md.
Boundary markers: No delimiters or instructions are used to isolate the data from the agent's core instructions.
Capability inventory: The skill has access to the exec tool, which can execute arbitrary shell commands.
Sanitization: No sanitization, escaping, or validation of the ingested memory content is mentioned or implemented.
[COMMAND_EXECUTION]: The skill uses the exec tool to perform searches on the local filesystem.
Evidence: Instructs the agent to use exec: grep -r PATTERN groups/ in SKILL.md.
Potential Risk: If the search pattern is derived directly from user input without proper escaping by the agent, it could lead to command injection.

memory-search