The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides tools for indexing and searching codebases, which act as ingestion points for untrusted data. Malicious instructions embedded in source code could influence the agent's behavior during discovery or retrieval tasks.
Ingestion points: Code snippets and repository graph data are ingested via the get_code_snippet, search_graph, and query_graph tools (referenced in SKILL.md).
Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore embedded instructions within retrieved codebase content.
Capability inventory: The skill allows for repository inspection via git and project deletion through the codebase-memory-mcp cli delete_project command.
Sanitization: The codebase_memory_cache.py script implements defensive path validation, including NUL character checks and absolute path normalization, to mitigate path traversal risks.
[COMMAND_EXECUTION]: The skill executes system commands via subprocesses to manage Git repositories and verify file access.
Evidence: scripts/codebase_memory_cache.py uses subprocess.run to execute git and /usr/sbin/lsof using argument lists to prevent shell injection. scripts/codebase-memory-graph.sh acts as a wrapper for these operations.
[DYNAMIC_EXECUTION]: The skill uses a gateway script to proxy commands to the MCP backend binary.
Evidence: scripts/codebase-memory-gateway.py.tmpl utilizes os.execve to pass execution to the backend binary using pinned paths established during installation, effectively delegating command execution to the underlying MCP tool.

codebase-memory-mcp