The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill reads and acts upon information found in .agents/handoffs/ and artifacts referenced by URL or file path. This data is treated as a "contract" for the session, which could lead the agent to follow malicious instructions embedded in those external sources.
Ingestion points: Files in .agents/handoffs/ (e.g., SKILL.md step 1) and referenced artifacts (specifications, plans, ADRs, issues, commits, and diffs) at arbitrary file paths or URLs (e.g., SKILL.md step 4).
Boundary markers: The instructions do not define specific delimiters or "ignore embedded instructions" warnings for the untrusted content.
Capability inventory: The skill directs the agent to use other tools via the Skill tool based on suggestions in the handoff files (e.g., SKILL.md step 5).
Sanitization: No explicit sanitization, escaping, or validation of the content of the handoff files or referenced artifacts is mentioned.

take-over