The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements an automated intake mechanism for processing external materials from the memory/inbox/ directory.
Ingestion points: The skill reads files (transcripts, PDFs, documents, notes) placed in memory/inbox/ when the /inbox command is triggered.
Boundary markers: The trust-boundary.md file explicitly labels chat sessions and tool outputs as untrusted input. However, the system is designed to transform this untrusted data into 'durable facts' and 'procedural knowledge'.
Capability inventory: The skill is authorized to write to sensitive repository configuration files, including AGENTS.md, .cursor/rules/, and .cursor/skills/, as well as creating regression tests.
Sanitization: While trust-boundary.md recommends paraphrasing over raw copying and mentions a 'quality filter', the ingestion of adversarial content in external documents could lead to the persistent injection of malicious instructions into the agent's long-term memory or repository-level rules.
[COMMAND_EXECUTION]: The skill utilizes command-line tools for searching memory.
Evidence: It uses rg (ripgrep) on POSIX systems and Select-String on Windows to search through the GLOBAL_MEMORY_ROOT and project memory directories.
Context: These operations are used for legitimate memory retrieval but rely on parameters (queries) derived from session context.
[PROMPT_INJECTION]: The skill uses forceful instructions to ensure autonomous operation during memory processing.
Evidence: In commands/inbox.md, the instructions state: 'Do this now. Do not ask for a longer prompt. Do not list the queue and wait. Do not wrap up the chat session.'
Context: This is a meta-instruction designed to prevent the LLM from engaging in unnecessary dialogue during the automated ingestion pipeline, but it mirrors 'ignore previous instructions' override patterns.

memo-session-skill