The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill records session context including objectives, goals, and learning data that is intended to be read by a future agent. This creates a surface for indirect prompt injection if the current task context has been influenced by untrusted data.
Ingestion points: Environment variables such as SAVE_SESSION_GOAL_OBJECTIVE and SAVE_SESSION_WORKING_ON are read by the scripts/save-session script.
Boundary markers: Absent; the content is written to .session/CURRENT.md under Markdown headers without specific delimiters to isolate potentially malicious embedded instructions from being interpreted by the next agent.
Capability inventory: The skill writes to the local filesystem using Bash redirection.
Sanitization: No escaping, filtering, or validation is performed on the captured strings before they are written to the checkpoint file.
[DYNAMIC_EXECUTION]: The skill invokes Python scripts from computed paths within the vendor's local directory structure.
Evidence: scripts/save-session executes python3 on a helper script located at $HOME/.codex/skills/session-orchestrate/scripts/session_workspace.py.
Evidence: scripts/validate.sh runs a validation script found at $HOME/.codex/skills/create-skill/scripts/audit.py or a project-local equivalent.

save-session