The Agent Skills Directory

[PROMPT_INJECTION]: The skill is designed to retrieve and process historical data (observations and prompts) from a memory database. This content is then used to provide context to the AI agent. If the stored data contains malicious instructions from an untrusted source encountered in a previous session, the agent might follow those instructions during retrieval.
Ingestion points: Data entering the context via the get_observations tool in SKILL.md.
Boundary markers: The skill lacks specific delimiters or warnings to treat historical data as untrusted or to ignore instructions embedded within it.
Capability inventory: The agent has the ability to search, filter, and fetch data, and it can interact with the project environment.
Sanitization: No evidence of validation or sanitization of the retrieved memory records.
[COMMAND_EXECUTION]: The skill documentation includes a section on 'User-Installable Grammars' using a .claude-mem.json configuration file. This configuration allows specifying a Node.js package name that is dynamically loaded to provide AST parsing for new languages.
Evidence: The skill explicitly mentions that custom grammars can be added by specifying a package name, such as tree-sitter-gleam, which must be installed and is then loaded by the tool.
Risk: Dynamically loading packages based on a configuration file allows for the execution of arbitrary code if an attacker can influence the contents of the .claude-mem.json file or the available packages in the environment.

mem-search