[HIGH] No system prompt injection of skills/rules/project-memory

[tuterx]

SystemPromptBuilder only injects CLAUDE.md files (12K char limit). No rules/ directory, no skill content injection, no project memory, no notepad.

Fix: Create PromptSourceRegistry trait → register rules/skills/memory/notepad sources → token-budget-aware injection.

[vgudur-dev]

The PromptSourceRegistry design is the right abstraction — and it has a security dimension worth building in from the start.

When multiple sources (rules/, skills/, memory, notepad) contribute to the system prompt, the assembled prompt loses provenance: the model can't distinguish which segment came from a trusted local file vs. a synced memory entry that may have been written by a tool result. This is the ASI06 (Memory Poisoning) attack surface — an attacker who can write to the memory or notepad store can inject instructions that arrive in the system prompt with the same trust level as the developer's own rules.

A few design suggestions for the registry:

1. Tag each segment with its source type (rules/, skill, memory, notepad) and trust tier at injection time. The model doesn't see the tags, but they enable runtime audit and anomaly detection.
2. Apply a content scan before injection for memory and notepad sources (lower-trust), but not for rules/ (developer-controlled). OWASP Agent Memory Guard exposes a scan_before_inject(segment, source_type) API designed for exactly this registry pattern.
3. Log the assembled prompt hash per session so you can detect if a memory entry changed the effective system prompt between sessions.

The token-budget-aware injection is a good constraint — just make sure lower-trust sources (memory, notepad) are trimmed before higher-trust ones (rules/, skills/) when the budget is tight.

[1716775457damn]

PromptSourceRegistry with source tagging and trust tiers is a solid design. The memory poisoning concern raised by @vgudur-dev is real — if tool-generated output can write to memory that later becomes part of the system prompt without sanitization, that's a significant injection vector. Should build in content scanning for untrusted sources from day one.

[Yeachan-Heo]

Tracked in ROADMAP.md as an architectural gap. This is a known limitation, not a bug.