The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests historical transcript data from multiple AI agents, which serves as a potential vector for indirect prompt injection if those transcripts contain adversarial content.
Ingestion points: The scripts/handoff.py script reads JSON and JSONL files from provider-specific directories (e.g., Cursor, Claude Code, Codex) as specified in references/providers.json to extract previous conversation turns.
Boundary markers: The skill instructions do not provide explicit delimiters or "ignore" directives to the agent when it is instructed to read the retrieved transcript content.
Capability inventory: The skill executes Git commands via subprocess.run and has the capability to read any file within the detected transcript directories.
Sanitization: The Python script performs minimal cleaning of specific tags like <user_query> and <timestamp> using regular expressions in the clean_user_text function, but it does not implement comprehensive sanitization against general LLM prompt injection patterns.
[COMMAND_EXECUTION]: The skill uses the subprocess module to execute Git commands for repository and worktree discovery.
Evidence: scripts/handoff.py contains calls to git rev-parse --show-toplevel and git worktree list --porcelain. These operations use static argument lists and do not incorporate unsanitized user-provided input into the command string.

melech-handoff