The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the $ARGUMENTS[0] variable to define the destination path for the handoff document without providing instructions for path validation or sanitization. This allows a user to provide a path containing directory traversal sequences (e.g., ../../.ssh/authorized_keys) which could result in overwriting sensitive system or configuration files.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by persisting untrusted session data into instructions for future agents. 1. Ingestion points: The skill reads the entire current conversation history (SKILL.md). 2. Boundary markers: The instructions do not require the use of delimiters or 'ignore' instructions for data processed from the session history. 3. Capability inventory: The skill performs file-write operations to the local filesystem (SKILL.md). 4. Sanitization: There are no requirements to escape or filter content before writing it to the handoff document, allowing malicious commands within the session to be propagated to subsequent agents.

handoff-create