The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file references/SETUP.md contains a hardcoded OpenAI API key prefix sk-... in a configuration example. While intended as a placeholder, using the actual service prefix (sk-) is a credential exposure risk that can lead to misconfiguration or accidental leakage.- [PROMPT_INJECTION]: The SKILL.md file contains instructions for 'Silent Operation', directing the agent to perform memory tasks without user notification or confirmation. This instruction to hide actions from the user is a concealment pattern that bypasses transparency guardrails.- [COMMAND_EXECUTION]: The scripts/file-search.sh script executes the clawdbot command using an unsanitized $QUERY shell variable. This provides a direct surface for command injection if user input is not properly validated before being passed to the script.- [INDIRECT_PROMPT_INJECTION]: The skill implements a persistent memory system that ingests untrusted data from conversation history and workspace files, which are later recalled into the agent's context.
Ingestion points: User conversation history (LanceDB), workspace files (File Search), and daily memory logs (memory/*.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat recalled memory as untrusted content.
Capability inventory: The skill possesses the ability to execute shell scripts and Python code based on context.
Sanitization: No sanitization or filtering logic is present to remove potentially malicious instructions from data stored in the memory systems.

triple-memory-2