The Agent Skills Directory

[PROMPT_INJECTION]: The skill uses high-authority instruction patterns in its internal system prompts to control model behavior, which mirrors techniques used in prompt engineering for constraint enforcement.
Evidence: In prompts/dedup-cluster.md, the instructions include a section titled "## HARD RULES (Non-Negotiable — Override All Other Instructions)" designed to force adherence to specific operational limits.
[PROMPT_INJECTION]: The skill's architecture creates a significant surface for indirect prompt injection, as it processes untrusted memory content through multiple LLM-driven decision phases.
Ingestion points: Untrusted data from vector memory stores, knowledge graphs, and diaries are ingested in Phase 1 (deduplication), Phase 3 (bloat splitting), and Phase 4 (invalidation) as described in SKILL.md.
Boundary markers: While the templates in the prompts/ directory use markdown headers and horizontal rules (---) to separate instructions from data, they lack explicit warnings for the model to ignore instructions embedded within the memory records themselves.
Capability inventory: The skill possesses the capability to update, create, and "invalidate" (effectively delete) records across the agent's persistent storage, and can invoke the find_memory tool to retrieve further content.
Sanitization: There is no evidence of input sanitization or escaping applied to the memory content ({{established}}, {{newcomer}}, {{cluster}}) before it is interpolated into the prompt templates.
[COMMAND_EXECUTION]: The skill performs dynamic capability mapping at runtime, which could be exploited to misdirect the agent to malicious tools.
Evidence: Phase 0 in SKILL.md instructs the agent to "discover capabilities from the tool surface" by scanning tool names and descriptions to find functions that match intents like "Memory mutation" or "Duplicate check." If an environment contains a malicious tool with a spoofed description, the gardener may inadvertently call it.

memory-gardener