The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design. It instructs the agent to read and strictly follow the content of 'handoff' files found in shared directories.
Ingestion points: The agent reads content from thoughts/shared/handoffs/, thoughts/shared/plans/, and thoughts/shared/research/ based on parameters or directory listing.
Boundary markers: There are no instructions to use delimiters or ignore embedded directives within these files; instead, the agent is told to 'Extract all sections' and 'Convert action items from handoff into todos'.
Capability inventory: The skill utilizes file reading (Read), task management (TodoWrite), and shell command execution (humanlayer thoughts sync).
Sanitization: The instructions lack any mechanism to sanitize or validate the imported data for malicious instructions before the agent adopts them as a course of action.

resume-handoff