The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's fundamental purpose is to generate a document containing instructions and state that a subsequent agent session will follow, creating a vulnerability surface where a malicious actor could inject instructions into a project file or conversation that then gets persisted into the handoff and executed by the next agent.
Ingestion points: The resuming agent is instructed to read the handoff file (e.g., handoffs/handoff-*.md) or the <handoff-context> block provided in the conversation (ref: ref/checklists/resume.md).
Boundary markers: The skill uses specific XML-like tags (<handoff-context>) to wrap the transport block, providing structural markers for the resuming agent.
Capability inventory: Resuming agents are expected to execute shell commands and modify files based on the 'Immediate Next Step' and 'Verification' sections of the generated document.
Sanitization: While the quality.md checklist and scripts/check-staleness.sh utility check for hardcoded secrets and unfilled placeholders, they do not specifically filter for malicious instructions or command injection patterns in the 'Next Step' or 'Open Questions' fields.
[COMMAND_EXECUTION]: The templates provided by the skill (e.g., ref/templates/handoff-coding.md) include dedicated sections for recording build, test, and verification shell commands. If an agent populates these fields based on untrusted or manipulated project data, it could lead to the execution of malicious commands by the resuming agent during the verification phase.

handoff