The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and displays narratives, titles, and observations from past sessions stored in agentmemory via the memory_smart_search tool.
Ingestion points: The skill processes results from the memory_smart_search tool (as defined in SKILL.md), which includes untrusted data from provenance channels like import, shared, and even previous user or agent sessions.
Capability inventory: The agent uses memory_smart_search to fetch this data and then interprets the narrative content to present it to the user.
Boundary markers: The instructions in SKILL.md and EXAMPLES.md show the content being presented directly (e.g., "Yes. In session 7f3a9c21 you decided to...") without the use of XML tags, markdown blocks, or explicit "ignore embedded instructions" warnings to prevent the LLM from following commands hidden in the recalled text.
Sanitization: No sanitization, validation, or filtering of the narrative content is described before the content is placed back into the agent's context.
[PROMPT_INJECTION]: The skill interpolates user-supplied input directly into the primary instruction context using the $ARGUMENTS placeholder in SKILL.md ("The user wants to recall past context about: $ARGUMENTS"). While this is standard for many agent platforms, it provides a direct surface for users to attempt to override skill instructions if the platform does not provide underlying protection.

recall