The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill establishes a persistent memory system that processes untrusted data from session logs, creating a surface for indirect prompt injection.
Ingestion points: The skill reads .jsonl session log files from the Claude Code project directory (e.g., C:\Users\renat\.claude\projects\C--Users-renat-skills as defined in scripts/config.py).
Boundary markers: Although SKILL.md contains a warning for the user to review summaries before syncing, the sync_to_memory function in scripts/active_context.py automates the transfer of generated content to the MEMORY.md file, which is automatically loaded by the agent platforms.
Capability inventory: The skill is capable of reading session logs and writing to markdown files (ACTIVE_CONTEXT.md, MEMORY.md, PROJECT_REGISTRY.md) and a SQLite database (context.db). It has no network exfiltration or shell execution capabilities.
Sanitization: The summarization logic in scripts/session_summary.py extracts content using regular expressions without additional escaping or filtering. This allows malicious instructions embedded in session data to be persisted into long-term context, where they may be interpreted as commands by the LLM in subsequent sessions.

context-agent