The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and summarizes the "current conversation," which constitutes an untrusted data source that could contain malicious instructions designed to influence the behavior of the next agent in the chain.
Ingestion points: SKILL.md processes conversation history and user-supplied arguments for the next session.
Boundary markers: The instructions do not specify any delimiters or safety boundaries for the summarized content.
Capability inventory: The skill writes to the local filesystem (temporary directory).
Sanitization: The skill includes an explicit instruction to hide sensitive information (API keys, passwords, PII), which mitigates data exposure but does not prevent logic injection.
[COMMAND_EXECUTION]: The skill instructs the agent to interact with the host operating system to resolve environment variables ($TMPDIR, %TEMP%) and write files to paths outside the active workspace.

handoff