The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to read and follow content from project documentation files (e.g., docs/project_notes/bugs.md) and "apply known solutions if found." This creates a surface for indirect prompt injection if an attacker can influence the content of these files, such as through a malicious Pull Request. An agent searching for a bug solution might encounter and execute a malicious instruction embedded in a fake bug report.
Ingestion points: docs/project_notes/bugs.md, docs/project_notes/decisions.md, docs/project_notes/key_facts.md, and docs/project_notes/issues.md in the project directory.
Boundary markers: No explicit boundary markers or "ignore instructions" wrappers are implemented for the ingested content.
Capability inventory: The skill allows the agent to perform file writes and search operations using grep. In the broader context of an AI coding agent, "applying a solution" can lead to arbitrary code modifications or executions.
Sanitization: There is no evidence of sanitization or filtering for the external content read from the documentation files.
[COMMAND_EXECUTION]: The skill instructions include the use of shell commands like grep to search through documentation files. These are used for legitimate utility purposes (e.g., grep -i "connection refused" docs/project_notes/bugs.md) and do not pose a direct threat.
[DATA_EXPOSURE]: The skill description mentions storing "credentials" in key_facts.md. While the skill body and templates provide extensive and clear warnings to NEVER store sensitive secrets (passwords, API keys) and instead use .env or secrets managers, the use of the term "credentials" in the metadata is ambiguous and could potentially lead to accidental data exposure by a user who misses the detailed warnings.

project-memory