The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill generates a handoff document by summarizing the current conversation and user-provided arguments for use by a subsequent agent. This creates a multi-step chain where malicious instructions in the initial conversation could be preserved in the summary and influence the next agent's behavior.
Ingestion points: The skill processes the "current conversation" and "user passed arguments" in SKILL.md.
Boundary markers: None mentioned; the agent is not instructed to use delimiters or ignore embedded instructions in the source text.
Capability inventory: The skill specifies a file-write capability to the system temporary directory.
Sanitization: The skill includes a instruction to redact sensitive information (API keys, passwords, PII), which mitigates data exposure but does not address instruction injection.
[DATA_EXFILTRATION]: The skill directs the agent to save the generated handoff document to the user OS temporary directory instead of the current workspace.
Evidence: The instructions in SKILL.md explicitly state: "Save to the temporary directory of the user's OS
not the current workspace."
Risk: While intended for convenience, writing data to system-level directories outside the workspace can lead to data leakage between different project contexts or users on shared systems.

handoff