The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its core memory functions. User conversation data is ingested via a synchronization hook into conversation_log.txt and processed into a vector database. This stored content is later retrieved and injected back into the agent's active context during memory recall. The current implementation lacks explicit boundary markers or sanitization logic to differentiate between stored data and active instructions, which could allow a malicious user to embed instructions in past conversations that influence the agent's future behavior.
Ingestion points: conversation_log.txt (captured via handler.js), fluid_remember tool, and the fluid_increment_summarize tool.
Boundary markers: None identified. Stored content is returned to the agent as JSON-formatted text without markers instructing the agent to ignore embedded commands.
Capability inventory: The skill has file system write access to its workspace and uses subprocess.run to coordinate internal scripts.
Sanitization: No filtering or sanitization of input data is performed before storage or after retrieval.
[COMMAND_EXECUTION]: The skill utilizes subprocess.run within wrapper.py and dream_daemon.py to invoke internal Python scripts for task dispatching and scheduled maintenance tasks (e.g., memory archiving). These operations are performed using safe list-based arguments rather than shell strings, which effectively prevents shell injection vulnerabilities. The execution is strictly limited to the skill's own local files.

fluid-memory