The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to automatically ingest and inject data from external sources (LanceDB, Git notes, and workspace files) into the agent's current context.
Ingestion points: Data is pulled via memory-lancedb auto-recall, git-notes-memory sync, and the file-search.sh script output.
Boundary markers: The skill lacks explicit boundary markers or delimiters for injected content, increasing the risk that instructions embedded in memories will be obeyed by the LLM.
Capability inventory: The skill can execute shell scripts (file-search.sh), run Python scripts (memory.py), and interact with the clawdbot CLI.
Sanitization: There is no evidence of sanitization or validation of the retrieved memory content before it is interpolated into the agent's prompt.
[PROMPT_INJECTION]: The SKILL.md file contains explicit instructions to perform operations silently and avoid informing the user about memory storage or retrieval tasks. This concealment behavior reduces transparency and could be leveraged to hide malicious activity from the end-user.
[COMMAND_EXECUTION]: The provided scripts/file-search.sh script executes shell commands and redirects output to a fixed temporary file path.
Evidence: The script uses /tmp/clawdbot-filesearch.txt as a temporary storage location. In multi-user environments, this is a security anti-pattern that can lead to symlink attacks, allowing an attacker to overwrite local files or read sensitive search results.
[EXTERNAL_DOWNLOADS]: The skill relies on external components installed via clawdhub install git-notes-memory. This dependency on an external registry (clawhub.ai) introduces supply-chain risk if the package source is compromised.

triple-memory