The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts scripts/create_handoff.py, scripts/check_staleness.py, and evals/setup_test_env.py execute local shell commands via subprocess.run to interact with git. These operations are used to retrieve branch names, commit history, and file status for project metadata. The commands are executed safely using argument lists rather than shell strings, preventing shell injection vulnerabilities.
[PROMPT_INJECTION]: The skill exhibits an inherent attack surface for indirect prompt injection (Category 8) because its primary function is to have the agent read and follow instructions stored in handoff files. While this is the intended purpose of the skill, it could be abused if an attacker places a malicious handoff file in a project's .claude/handoffs/ directory.
Ingestion points: The agent is instructed in SKILL.md (RESUME Workflow) to read the handoff document completely before taking action.
Boundary markers: The skill does not employ explicit boundary markers or XML-style tags to isolate the handoff instructions from its system context.
Capability inventory: The skill has the capability to write files and execute git commands.
Sanitization: scripts/validate_handoff.py checks for incomplete placeholders and potential secrets but does not sanitize the natural language instructions for malicious patterns.
[CREDENTIALS_UNSAFE]: The script scripts/validate_handoff.py contains a library of hardcoded regular expression patterns (e.g., for OpenAI keys, AWS secrets, and Bearer tokens). These are used defensively to warn users if they accidentally include secrets in a handoff file and do not represent a leak of actual credentials within the skill itself.

session-handoff