The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests raw session buffers containing arbitrary command outputs and file content edits, creating a surface for indirect prompt injection where malicious data could influence the distillation process.
Ingestion points: Reads from DATA/buffer/session-*.md and DATA/HANDOFF.md.
Boundary markers: Mentions compaction-boundary markers but lacks explicit delimiters to prevent the agent from following instructions embedded in the session data.
Capability inventory: Performs file writes (logs, handoff, memory topic files) and shell-based git operations (add, commit, push).
Sanitization: Implements a secret scanning mechanism for credentials but does not include sanitization for natural language instructions in the processed data.
[DATA_EXFILTRATION]: The skill aggregates potentially sensitive session information into persistent logs and offers to push these to a remote Git repository.
Evidence: The skill distill commands, file changes, and decisions into HANDOFF.md and DATA/logs/, then offers to git push these artifacts.
Mitigation: Includes a specific 'Reminders' section instructing the agent to scan for and redact secrets (tokens, keys, passwords) before writing or committing logs.
[COMMAND_EXECUTION]: The skill uses Git commands to manage the lifecycle of handoff files.
Evidence: Explicit instructions to use git check-ignore, git add, git commit, and git push to manage the handoff artifacts.

handoff