The Agent Skills Directory

[PROMPT_INJECTION]: The 'Resume from a handoff' feature (Mode 2) creates a surface for indirect prompt injection. The skill instructs the agent to treat 'Locked decisions' within the handoff document as 'settled' and explicitly states 'do not reopen these.' This instruction could allow a malicious handoff file to bypass agent constraints or dictate unauthorized behavior.
Ingestion points: The skill accepts a file path via the resume <path> trigger to load external session context.
Boundary markers: Absent. The instructions do not include markers or warnings to verify the integrity or source of the handoff file before adoption.
Capability inventory: The skill possesses the ability to read and write to the local file system and execute git commands.
Sanitization: The skill lacks validation or sanitization logic to verify that resumed context does not contain malicious instructions or overrides.
[DATA_EXFILTRATION]: The skill facilitates the extraction of session context, including current state and resolved decisions, into local markdown files. While it provides robust instructions for redacting secrets (API keys, tokens, PII) and recommends gitignoring the storage directory, the process of writing internal agent state to disk constitutes a local data exposure risk if the redaction or gitignore steps fail.
Sensitive file paths: The skill targets the .handoff/ directory and potentially docs/handoffs/ for persistent storage.
Redaction policy: The skill identifies and redacts secrets like REDIS_URL and .env.local contents, which is a mitigating safety practice.

handoff