The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes the entire conversation history, which is untrusted data that may contain malicious instructions designed to influence the handoff document.
Ingestion points: The agent context is populated by the "current conversation" summary as described in SKILL.md.
Boundary markers: None present in the instructions to separate conversation data from the summarization logic.
Capability inventory: The agent is instructed to perform a file system write operation to the user's OS temporary directory.
Sanitization: The instructions include a manual redaction requirement for API keys and PII, but no technical sanitization or escaping of input data to prevent prompt injection.
[COMMAND_EXECUTION]: The skill explicitly instructs the agent to save data to the temporary directory of the user's OS, which involves file system operations outside the standard project workspace.
Evidence: SKILL.md specifies "Save to the temporary directory of the user's OS
not the current workspace."

handoff