The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon "AI-Session-Export" content provided by users. Because this content includes past decisions, verified commands, and task scopes, it represents a surface where a malicious export could attempt to influence the agent's logic or downstream actions.
Ingestion points: Data is ingested through user prompts or by reading external files as defined in the "Obtain the export" workflow in SKILL.md.
Boundary markers: The instructions require checking for specific headers like # AI-Session-Export and a Format-version, which serves as a basic structure but does not include hardened isolation delimiters.
Capability inventory: The skill utilizes git log to inspect repository history and provides instructions for executing "Verified commands" found in the export file.
Sanitization: The workflow explicitly mandates a "Verify the export against reality" step to detect drift and strictly forbids using the export to bypass permission prompts or safety filters, treating external commands as records rather than granted permissions.

ai-session-restore