The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's core workflow involves extracting structured data from session transcripts and re-injecting it into the prompt context during future sessions via the +recall mechanism.
Ingestion points: The skill sweeps the current session transcript (untrusted data) during the 'Two-Phase Extraction' process defined in modules/two-phase-extraction.md.
Boundary markers: There are no explicit instructions to wrap the extracted content in delimiters (e.g., XML tags) or to include warnings for the agent to ignore instructions embedded within retrieved units.
Capability inventory: The skill utilizes file system writes to stage data in data/state/handoff_units.json, which is then processed by a platform-level recall hook (plugins/memory-palace/hooks/recall.py) to inject content into subsequent turns.
Sanitization: The instructions lack requirements for sanitizing or escaping the content of the State, Why, or Open fields before they are stored and later re-injected. This allows potentially malicious instructions or adversarial content present in a session transcript to be persisted across session boundaries.

session-handoff