The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes multiple shell commands to gather environment data and capture project state. Specifically, it uses git to retrieve branch information, status, and full diffs of the working tree. It also attempts to execute an external binary named specweave if it is present on the system's PATH, passing user-provided strings as command-line arguments.
[INDIRECT_PROMPT_INJECTION]: The skill creates a handoff document that is explicitly intended to be consumed by another AI agent as "ground truth." This creates an attack surface where malicious content within the repository (captured via git diff) or user-supplied inputs could influence the behavior of the receiving agent.
Ingestion points: The skill ingests untrusted data from git diff, git status, and multiple user-provided interview fields such as reason, summary, next, gotcha, and decisions (SKILL.md).
Boundary markers: The output uses markdown headers and specific blocks like BEGIN HANDOFF and END HANDOFF to delimit the content, but lacks instructions for the receiving agent to treat the embedded data as non-executable (SKILL.md).
Capability inventory: The skill has the capability to execute shell commands (git, sed, mkdir, printf) and invoke an external engine (specweave) (SKILL.md).
Sanitization: A heuristic secret scrubber using sed and regex patterns is implemented to mask common API keys and tokens, but no sanitization is performed to prevent prompt injection or markdown breaking within the interpolated fields (SKILL.md).
[CREDENTIALS_UNSAFE]: The skill captures the full output of git diff HEAD and git diff --cached into a file located at .handoff/handoff.diff. Although a regex-based scrubber is applied, the capture of uncommitted changes poses a risk of exposing sensitive data, environment variables, or hardcoded secrets if they are not caught by the heuristic patterns.

handoff