The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's architecture for persisting and retrieving cross-session state creates a surface for indirect prompt injection attacks.
Ingestion points: Untrusted external data is ingested through IntegratedMemorySystem.store_fact in scripts/memory_store.py and VectorStore.add in references/implementation.md.
Boundary markers: The implementation lacks delimiters or explicit instructions to treat retrieved memory content as untrusted data, which may lead the agent to execute instructions embedded within those memories.
Capability inventory: Functions like IntegratedMemorySystem.retrieve_memories and MemoryContextIntegrator.build_context are specifically designed to inject stored data back into the agent's active context to guide generation.
Sanitization: There is no evidence of sanitization, validation, or escaping of the text content before it is stored or retrieved for context injection.

memory-systems