The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process handoff files created in previous sessions, which creates a surface for indirect prompt injection if those files contain malicious instructions.
Ingestion points: The agent is instructed in SKILL.md to "Read the relevant handoff document completely" during the RESUME Workflow. Additionally, scripts/list_handoffs.py, scripts/check_staleness.py, and scripts/validate_handoff.py ingest and parse these files.
Boundary markers: There are no explicit delimiters or "ignore instructions" warnings defined to wrap the content of the handoff documents when they are loaded into the agent's context.
Capability inventory: The skill can execute local shell commands (Git) and write new files to the project directory.
Sanitization: The validate_handoff.py script checks for hardcoded secrets and incomplete placeholders but does not include sanitization logic for the natural language content to prevent instruction overrides.
[COMMAND_EXECUTION]: Several scripts use the subprocess module to execute Git commands on the local system.
Evidence: subprocess.run() calls are located in scripts/check_staleness.py, scripts/create_handoff.py, and evals/setup_test_env.py. These calls facilitate project metadata discovery, such as branch status, recent commits, and file differences. The commands are constructed using static lists, which mitigates direct shell injection risk, though they operate based on directory paths parsed from the project environment.

session-handoff