The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session history and local handoff files to summarize or resume work, which is a common surface for indirect prompt injection.
Ingestion points: The agent context and external handoff files are read during the 'Author' and 'Resume' workflows described in SKILL.md.
Boundary markers: The skill does not define specific delimiters for ingested session content, though the 'Resume' mode requires the agent to flag discrepancies to the user.
Capability inventory: File-write operations to the local filesystem (SKILL.md).
Sanitization: Explicit redaction rules for credentials and secrets are enforced in the 'AI Self-Check' and 'Workflow' sections of SKILL.md.
[DATA_EXPOSURE]: The skill handles potentially sensitive session data by writing it to the local filesystem.
Evidence: SKILL.md mandates that .handoff/ directories must be added to .gitignore to prevent accidental commits.
Evidence: The skill includes an 'AI Self-Check' that explicitly requires the redaction of API keys, passwords, tokens, and PII before writing the handoff document.

handoff