The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the Bash tool to run local scripts (./scripts/session-control.sh and ./scripts/session-state.sh) to manage session transitions and persistence.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection and subsequent command injection as it interpolates workflow data directly into shell commands in references/session-control.md and references/state-transition.md.
Ingestion points: Workflow variables including resume_session_id, fork_reason, and event_data (a JSON string) enter the context from previous agent steps or environment variables.
Boundary markers: No delimiters or boundary instructions are present to prevent embedded shell metacharacters from escaping the command string.
Capability inventory: The skill has Bash, Write, and Edit permissions, allowing it to modify the filesystem and execute arbitrary shell code if an injection occurs.
Sanitization: There is no prescribed sanitization or validation logic (e.g., shell-escaping the <text> or <json> placeholders) in the instruction templates.

session