The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from past session histories via the read and search commands. This creates an attack surface where instructions embedded in previous conversations could influence the agent's current task execution.
Ingestion points: Conversation messages are retrieved via bun session-tool read and bun session-tool search commands as described in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when handling the retrieved history.
Capability inventory: The tool allows the agent to read and search local session storage.
Sanitization: No sanitization or content filtering is mentioned for the retrieved session data.

session-tool