The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to clone a repository from a third-party source not listed as a trusted vendor.
Evidence: git clone https://github.com/CodeAbra/iai-mcp.git in SKILL.md.
[REMOTE_CODE_EXECUTION]: The installation process involves executing a shell script downloaded from an external repository, which can perform arbitrary actions on the host system.
Evidence: bash scripts/install.sh executed after cloning the repository in SKILL.md.
[PERSISTENCE]: The skill uses multiple methods to ensure its components run persistently and automatically.
Evidence: It modifies shell profiles (~/.zshrc or ~/.bashrc) to alter the system PATH.
Evidence: It registers a daemon with launchd on macOS during the installation process.
Evidence: It installs lifecycle hooks to ~/.claude/hooks/ (iai-mcp-turn-capture.sh, iai-mcp-session-capture.sh, iai-mcp-session-recall.sh) which execute automatically during agent startup, prompt submission, and session termination.
[COMMAND_EXECUTION]: The skill utilizes system-level commands to manage processes and interact with the operating system.
Evidence: Use of killall -9 iai-mcp-daemon to force-terminate processes.
Evidence: Programmatic execution of CLI tools via subprocess.run(["iai-mcp", "query", text, "--json"]).
[DATA_EXFILTRATION]: While the skill claims local-only operation, it establishes a mechanism to capture and store all conversation turns verbatim, creating a high-value data store. It also provides explicit examples of how to send this data to external servers.
Evidence: Pattern 4 in SKILL.md demonstrates using curl to POST exported memory data to https://my-backup.example.com/sync using a bearer token.
[INDIRECT_PROMPT_INJECTION]: The skill creates a feedback loop where previous conversation content is stored and then re-injected into future sessions, which is a primary surface for indirect prompt injection attacks.
Ingestion points: Conversation turns are captured via ~/.claude/hooks/iai-mcp-turn-capture.sh (SKILL.md).
Boundary markers: No explicit boundary markers or "ignore embedded instructions" warnings are documented for the recalled context.
Capability inventory: The skill possesses file write capabilities, shell command execution via hooks, and the ability to inject arbitrary text into the agent's context during SessionStart.
Sanitization: The documentation does not mention any sanitization or filtering of the recalled memory content before it is provided back to the AI model.

iai-mcp-memory-server