The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Claude Code's auto-memory system which can contain malicious instructions from previous session logs or tool outputs.
Ingestion points: The memory-analyst agent reads ~/.claude/projects/<project-path>/memory/MEMORY.md and associated topic files (e.g., debugging.md, patterns.md).
Boundary markers: None identified. The agent processes the raw markdown content of memory files.
Capability inventory: The skill uses cat, ls, and find to read files and verify their existence. It can also suggest permanent changes to the project's CLAUDE.md and .claude/rules/ files.
Sanitization: No sanitization or filtering of the ingested memory content is performed before analysis.
[DATA_EXPOSURE]: The skill accesses the ~/.claude/projects/ directory, which resides outside the project workspace and contains internal agent metadata and session history.
Evidence: The /si:review command calculates the memory path using: MEMORY_DIR="$HOME/.claude/projects/$(pwd | sed 's|/|%2F|g; s|%2F|/|; s|^/||')/memory".
[COMMAND_EXECUTION]: The skill uses shell commands and pipelines to locate and verify files on the host system.
Evidence: Use of sed, pwd, ls, and find within the review skill and the memory-analyst agent instructions.

self-improving-agent