The Agent Skills Directory

[PROMPT_INJECTION]: The 'MODO RETOMA' (Resume Mode) instructions command the agent to "follow strictly what is indicated in the document" (siguiendo estrictamente lo indicado en el documento). Specifically, the agent is instructed to adopt the "Próximos pasos" and "Comportamiento del agente" sections as active directives, which could lead the agent to execute unintended actions or bypass its own safety constraints if the file content is adversarial.
[DATA_EXFILTRATION]: While the skill includes a rule to redact sensitive information during file generation, the resume process requires reading files from the local filesystem. Malicious instructions embedded in a handoff file could potentially lead the agent to access or reveal sensitive data due to the high trust placed in the file's contents during the session restoration process.
[INDIRECT_PROMPT_INJECTION]: The skill provides an ingestion point for data that directly influences the agent's future behavior.
Ingestion points: The agent reads and processes the content of handoff_*.md files located in the repository root (SKILL.md).
Boundary markers: The skill lacks explicit boundary markers or instructions to treat the file content as untrusted; it instead commands the agent to adhere strictly to the embedded instructions.
Capability inventory: The skill is intended to run in environments where the agent has file system access and potentially shell access, which could be exploited through instructions in a malicious handoff file.
Sanitization: There is no mechanism described for sanitizing or validating the contents of the handoff files before the agent follows the instructions they contain.

traspaso