The Agent Skills Directory

[PROMPT_INJECTION]: The 'pop' mechanism allows for indirect prompt injection by instructing the agent to load and follow instructions from a project-controlled file (AGENTS.md). A malicious or compromised session stash could contain instructions that hijack the agent's behavior when the operator triggers a resume.
Ingestion points: The agent is instructed to read docs/session-stash/<name>/AGENTS.md first to 'self-orient' and route subsequent loading actions.
Boundary markers: While a 'Scrubbing Contract' exists for the creation of stashes, there are no technical boundaries or 'ignore' instructions implemented for the resuming agent to prevent it from obeying malicious instructions embedded in the file.
Capability inventory: The agent has access to Bash, Read, Write, Edit, Grep, and Glob tools.
Sanitization: There is no evidence of sanitization or validation of the instructions contained within AGENTS.md before the agent processes them.
[DATA_EXFILTRATION]: The skill is designed to aggregate and store highly sensitive information, including full session transcripts and uncommitted work (patch.diff).
Evidence: The skill captures git-tag.txt, patch.diff, file-map.md, and harness-agnostic transcripts as part of the stash process. Although encryption via age is required, the accumulation of this data in a predictable directory structure increases the impact of a potential credential leak or key compromise.
[COMMAND_EXECUTION]: The skill uses shell commands to perform core operations, including git state capture and encryption.
Evidence: Instructions explicitly mandate the use of git rev-parse HEAD, git diff, and the age encryption utility via the Bash tool. The 'pop' process involves dynamic loading of instructions which may lead to further unverified command execution.

session-stash