The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from a git repository (commit messages, branch names) and renders them into the agent's context. While the skill instructs the agent to 'Render only the commits the tool returned', it lacks explicit instructions to treat the commit message content as untrusted or to ignore any potential instructions embedded within the git history. An attacker could craft a commit message containing malicious instructions that the agent might inadvertently execute when the user requests a commit history.
Ingestion points: SKILL.md, EXAMPLES.md (via memory_commits tool and GET /agentmemory/commits REST fallback).
Boundary markers: Absent. There are no delimiters or warnings to ignore instructions within the retrieved commit data.
Capability inventory: The skill itself primarily performs reads and rendering, but it exists within a platform (e.g., Claude Code, Hermes) that typically has file-system and terminal access.
Sanitization: Absent. The instructions focus on URL-encoding for the query, not sanitizing the content returned from the API.
[DATA_EXPOSURE]: The TROUBLESHOOTING.md file contains instructions for the agent to read local credential files (~/.agentmemory/.env, ~/.agentmemory/secret) to facilitate a REST fallback. While it explicitly warns 'Never send a local-file secret to a remote URL' and 'Do not print or save the secret', the pattern of an agent reading local secrets introduces a potential exposure risk if the agent is subsequently compromised or tricked.

commit-history