The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to have the agent write instructions to a file and later read and obey them. This creates a vulnerability surface where an attacker who can modify the local filesystem could inject malicious prompts into the handoff documents.
Ingestion points: The agent reads the active_handoff_path specified in ~/.openclaw/skill-state/task-handoff/state.yaml and processes the Markdown content in the referenced file.
Boundary markers: There are no explicit boundary markers or instructions to treat the content of the handoff file as untrusted data. The agent is explicitly told to 'Read the handoff document completely' and 'Start from What's Next'.
Capability inventory: The skill itself performs file system operations (read/write). The broader agent context may have significant capabilities that could be abused if the agent obeys injected instructions.
Sanitization: The skill does not include any validation, escaping, or filtering for the content of the handoff files.

task-handoff