The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a custom CLI tool at ~/.claude/bin/claude-memory and perform file system operations (read, write, move, and truncate) on files within the ~/.claude/ directory. This includes destructive operations like clearing the memory store using shell redirection and mv commands.
[PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection. It processes raw session transcripts from ~/.claude/diary/ into patterns, which can then be promoted to active rules stored in CLAUDE.md. Malicious instructions embedded in past interactions could potentially bypass filters and influence future agent behavior.
Ingestion points: Raw session transcripts in ~/.claude/diary/ act as the entry point for untrusted data into the memory pipeline.
Boundary markers: Absent. The skill does not define delimiters or specific "ignore embedded instructions" warnings for the content being processed into rules.
Capability inventory: The skill can execute shell commands, modify its own core instruction set (CLAUDE.md), and manipulate local files in the user's home directory.
Sanitization: Absent. There is no evidence of filtering, escaping, or validation logic intended to prevent malicious instructions within session diaries from being extracted as patterns.

memory-store