The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides bash command templates that interpolate user-supplied queries directly into shell commands within double quotes (e.g., npx ruvector search "QUERY"). This pattern is vulnerable to shell command injection if the user query contains shell metacharacters such as backticks, command separators (;, &&), or variable expansion syntax ($()), as the instructions do not include sanitization steps.
[EXTERNAL_DOWNLOADS]: The skill relies on npx to download and execute external CLI tools, specifically @claude-flow/cli and ruvector, at runtime. Executing unpinned or external packages from remote registries introduces supply chain risks.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection as it processes and synthesizes data from multiple external sources.
Ingestion points: Retrieval of untrusted data from memory namespaces including patterns, tasks, solutions, feedback, and security as described in SKILL.md.
Boundary markers: No explicit delimiters or instructions to treat retrieved memory as data rather than instructions are provided for the synthesis phase.
Capability inventory: Access to Bash (via npx), file system Read, and specialized memory search/store MCP tools.
Sanitization: There is no evidence of sanitization or escaping of the retrieved memory contents before they are passed to the context-synthesize tool or interpreted by the agent.

memory-search