The Agent Skills Directory

[DATA_EXPOSURE]: The skill is designed to search for and read sensitive agent conversation transcripts from the user's home directory.
Evidence: The findClaudeTranscript and findCodexTranscript functions in scripts/matrix-handoff.mjs scan ~/.claude/projects/ and ~/.codex/sessions/ for .jsonl files to include in the handoff bundle.
[COMMAND_EXECUTION]: The script executes several local system commands to package the environment and interact with the Matrix platform.
Evidence: scripts/matrix-handoff.mjs uses execFile to run git (for file discovery and metadata), tar (for bundling), and the matrix CLI (for uploading and session management).
[REMOTE_CODE_EXECUTION]: The skill generates a shell script locally and executes it on the remote Matrix host to extract the project bundle.
Evidence: The buildRemoteExtractScript function in scripts/matrix-handoff.mjs constructs a multi-line shell command that is passed to matrix run -- sh -lc on the remote system.
[INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface where a remote agent is instructed to process untrusted data that could contain malicious instructions.
Ingestion points: Reads all cached and untracked files in the repository (via git ls-files), local agent transcripts (.jsonl), and an agent-written continuation brief.
Boundary markers: The remote agent is prompted with: "Continue this task from the Matrix handoff. First read .matrix-handoff/README.md and .matrix-handoff/manifest.json, inspect the working tree, then proceed from the continuation brief." No explicit delimiters or safety warnings are included to prevent the agent from obeying instructions hidden within the brief or the repository files.
Capability inventory: The remote agent session is started with a full shell (matrix shell new) and has the same capabilities as a standard Matrix OS agent.
Sanitization: The skill uses isSafeHandoffPath to filter sensitive file names and shellQuote to sanitize the final prompt string, but it does not sanitize the content of the uploaded files or the transcript for embedded instructions.

matrix-handoff