The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a mechanism for content from MEMORY.md (which contains observations from previous sessions, code, and chats) to be promoted to CLAUDE.md or .claude/rules/, becoming permanent system instructions.
Ingestion points: The agent reads from MEMORY.md and takes user descriptions to filter and move patterns.
Capability inventory: The agent uses grep for searching and has the ability to read/write to the project's root and rule directories.
Sanitization: There are no specific instructions for the agent to sanitize or validate the content extracted from memory before it is written to permanent rule files.
Boundary markers: The process lacks explicit delimiters or instructions to ignore embedded commands within the memory data, allowing potential malicious patterns to be 'enforced' permanently.
[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using keywords derived from the user's pattern description.
Evidence: The command grep -ni "<keywords>" "$MEMORY_DIR/MEMORY.md" in Step 2 directly incorporates user-provided keywords into a shell command. If the agent does not properly escape these keywords, it could lead to command injection.
[DATA_EXPOSURE]: The skill accesses internal agent configuration and memory files stored in the user's home directory.
Evidence: The skill calculates and accesses paths within $HOME/.claude/projects/ and ~/.claude/CLAUDE.md. While these are necessary for the skill's functionality, they represent access to sensitive agent-specific data and configuration.

promote