The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's instructions in SKILL.md direct the agent to use the Bash tool to execute a Node.js script with an interpolated search query: node .claude/lib/memory/memory-search.cjs "your query". This pattern is vulnerable to shell injection. If an agent-generated or user-influenced query contains shell metacharacters (such as backticks, semicolons, or dollar signs), it could lead to arbitrary command execution on the host system despite the use of double quotes.
[PROMPT_INJECTION]: The skill facilitates Indirect Prompt Injection by retrieving data from potentially untrusted memory files and presenting it as authoritative context for the agent to follow.
Ingestion points: Data is read from files in .claude/context/memory/, including learnings.md, decisions.md, issues.md, gotchas.json, and patterns.json.
Boundary markers: The search results are presented with source file names and similarity scores, but the content previews lack delimiters or instructions to ignore embedded commands.
Capability inventory: The agent is equipped with the Bash tool and instructed to "follow [the results] exactly as presented."
Sanitization: There is no evidence of sanitization, filtering, or escaping of the retrieved content before it is injected into the agent's prompt context.
[EXTERNAL_DOWNLOADS]: The skill references and executes code from paths outside its own package structure, specifically ../../../../.claude/tools/observability/send-event.cjs and .claude/lib/memory/memory-search.cjs. Relying on files deep in the parent directory structure assumes a specific environment layout and could lead to the execution of unintended or malicious files if the environment is not strictly controlled.

memory-search