The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill is architected to store sensitive Memos access_token credentials in a plain-text config.json file within the skill directory. While the distributed config.json uses placeholders, the instructions in SKILL.md (Scenario 5) explicitly direct the agent to write live user-provided tokens to this file using Python script execution. This practices exposes secrets to any process or user with read access to the skill's directory.
[DYNAMIC_EXECUTION]: The skill includes Python code snippets for runtime file management, specifically writing configuration data to config.json. This capability for self-modification of configuration files could be potentially leveraged to manipulate agent settings if the agent's logic is subverted through other means.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection due to its core functionality of retrieving and processing external content.
Ingestion points: The agent retrieves untrusted content from the Memos API via GET /api/v1/memos, GET /api/v1/memos/{memo}, and GET /api/v1/memos/{memo}/comments as described in SKILL.md and references/api-reference.md.
Boundary markers: There are no explicit boundary markers or instructions to the agent to disregard instructions embedded within the retrieved memo content.
Capability inventory: The skill has the capability to perform arbitrary network requests and write to the filesystem (for configuration management).
Sanitization: No sanitization, validation, or escaping of the retrieved memo or comment data is performed before the data is integrated into the agent's context.

memos-skill