The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/memory.py uses subprocess.run to call git remote and git branch for metadata extraction. These calls are implemented safely using argument lists to prevent shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill reads project-specific 'learnings' from a local file and presents them to the agent, creating an attack surface where malicious data in the memory store could influence agent behavior.
Ingestion points: Data is read from ~/.mystack/projects/<slug>/learnings.jsonl by scripts/memory.py.
Boundary markers: Content is rendered as Markdown lists; however, there are no specific instructions to the agent to disregard instructions found within the memory entries.
Capability inventory: The skill has permission to use Bash, Read, Write, and Edit tools.
Sanitization: Data is parsed using json.loads, but the text content is not filtered for prompt injection patterns before rendering.

project-memory