The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and incorporate content from "handoffs" (summaries, open questions, and next steps) created in previous sessions or by other operators into the current agent context, which creates a surface for indirect prompt injection.
Ingestion points: Data is ingested via memory_handoff_list and memory_handoff_accept as described in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or warnings to treat the fetched handoff content as untrusted data.
Capability inventory: The skill possesses the ability to read and write session metadata, including creating new handoffs and canceling existing ones.
Sanitization: No sanitization or filtering logic is prescribed for the content of the handoffs before they are processed by the agent.
[PRIVILEGE_ESCALATION]: The skill documentation includes an any_owner: true parameter for the accept and cancel tools, which facilitates access to data across operator boundaries.
Evidence: SKILL.md describes this as a "root-only recovery action over another operator's context." While the instructions restrict its use to explicit user requests, the presence of this capability in the skill's operational logic allows for the potential exposure of data belonging to different users in shared project environments.

ai-memory-handoff