The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources, including git diff outputs, commit messages, and user-provided session notes. This data is interpolated into the final handoff document. While the skill instructs the agent to label user context clearly, an attacker could embed malicious instructions in commit messages or code comments designed to influence the behavior of the agent generating the document or the agent/developer consuming the handoff.
Ingestion points: git diff, git log, and user-supplied review comments or notes.
Boundary markers: The skill uses markdown headers and a structured template, but does not employ hardened delimiters (like XML tags with random nonces) for the untrusted diff output.
Capability inventory: The skill can execute local git commands, GitHub CLI commands, and write to the local file system (.handoffs/ directory).
Sanitization: The instructions explicitly require labeling user-provided content vs verified evidence, which serves as a basic manual sanitization step.
[COMMAND_EXECUTION]: The skill relies on executing shell commands (git status, git log, git diff, and gh pr diff) to gather data. These commands are used within the scope of the repository and the GitHub CLI (a well-known service), representing standard developer workflow automation.

gen-frontend-handoff