The Agent Skills Directory

[METADATA_POISONING]: The skill metadata and instructions contain deceptive information, specifically citing 'Opus 5.5 guidance', which refers to a model version that does not exist. This appears to be an attempt to mimic official or authoritative documentation style. Additionally, the author listed in the YAML frontmatter ('OrchestKit') conflicts with the system-identified author ('yonatangross'), creating ambiguity about the skill's origin.
[INDIRECT_PROMPT_INJECTION]: The skill provides a mechanism to ingest arbitrary user-provided text through the $ARGUMENTS parameter and persist it in long-term memory (knowledge graph and filesystem). Because this content is not sanitized or filtered, it creates a surface for indirect prompt injection where malicious instructions could be stored and later retrieved, potentially hijacking the agent's context in subsequent sessions.
Ingestion points: The skill captures raw user input via the $ARGUMENTS variable in SKILL.md for storage.
Boundary markers: Stored observations and markdown entries lack explicit delimiters or safety instructions to prevent the content from being interpreted as active commands during future recall.
Capability inventory: The skill utilizes graph modification tools (mcp__memory__create_entities, mcp__memory__add_observations) and has permission to perform file system updates in user and project memory directories.
Sanitization: No input validation, escaping, or filtering is performed on the text before it is committed to the knowledge graph or markdown files.

remember