The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands like grep to search within memory files. These commands incorporate user-supplied <keywords> and <pattern> strings directly into the shell context, which can lead to command injection if the input contains shell metacharacters.
[INDIRECT_PROMPT_INJECTION]: The skill sources its instructions from MEMORY.md, which is a file populated with 'auto-memory' from past conversation history. This creates a vector where a malicious prompt provided in a previous session could be permanently promoted into the project's enforced rule system (CLAUDE.md).
Ingestion points: MEMORY.md is read using grep in Step 2 and Step 6.
Boundary markers: The workflow includes a manual confirmation step where the agent shows matching entries to the user before proceeding.
Capability inventory: The skill has capabilities to read files (grep), write to project configuration (CLAUDE.md, .claude/rules/), and delete lines from memory files.
Sanitization: Step 4 defines a distillation process intended to transform descriptive notes into prescriptive rules, which provides a layer of manual/agent review.
[PERSISTENCE]: The skill's primary function is to modify project-level and global rule files (CLAUDE.md). This enables the creation of persistent instructions that dictate agent behavior across all future sessions in that environment.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses the ~/.claude/projects/ directory to read and modify MEMORY.md. This directory contains sensitive internal agent state, including project-specific history and automated notes that are not normally intended for direct external manipulation.

promote