The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of historical conversation data, which serves as a significant attack surface for indirect prompt injection.
Ingestion points: Historical logs are retrieved using the mcp__plugin_episodic-memory_episodic-memory__read tool as described in MCP-TOOLS.md and SKILL.md.
Boundary markers: The instructions lack specific delimiters or warnings to prevent the agent from being influenced by instructions embedded within the historical data.
Capability inventory: The agent has access to search and read tools that interact with the file system, providing a path for potential exploitation if the agent is subverted by malicious history.
Sanitization: There is no mention of sanitization or validation of the content retrieved from the conversation archive files.
[DATA_EXFILTRATION]: The skill utilizes tools that provide access to sensitive user data and arbitrary file paths on the host system.
Sensitive file access: The skill documentation explicitly points to the user's ~/.config/superpowers/conversation-archive/ directory, which contains private interaction history.
Unrestricted path parameters: The path parameter for the read tool is defined as an absolute path in MCP-TOOLS.md. Without proper sandboxing or constraints in the prompt, this allows the agent to read arbitrary system files if instructed to do so.

remembering-conversations