The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from a knowledge graph to build a unified context for the agent. This represents a potential indirect prompt injection surface if the memory content (which could originate from untrusted external sources like web pages) contains malicious instructions.
Ingestion points: Data is ingested via mcp__memory__search_nodes in SKILL.md and references/query-merging.md.
Boundary markers: There are no instructions to the agent to treat retrieved memory observations as untrusted data or to use delimiters to prevent command leakage.
Capability inventory: The skill is permitted to use Bash and several memory mutation tools (mcp__memory__create_entities, mcp__memory__create_relations, etc.).
Sanitization: No sanitization or validation of the text content within nodes is specified before it is used for ranking or context assembly.
[COMMAND_EXECUTION]: The skill's allowed-tools includes Bash, and SKILL.md mentions integration points prompt/memory-fabric-context.sh and stop/memory-fabric-sync.sh. These shell scripts are executed as session hooks, but their contents were not provided in the analyzed file set, which prevents verification of their security impact.

memory-fabric