The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill creates a handoff document meant to be consumed by a future agent session, establishing a surface for indirect prompt injection where malicious instructions could be carried across session boundaries.
Ingestion points: The skill captures data from the current session's history, user input, and referenced files (SKILL.md Workflow Steps 2-4) to populate the "Locked decisions", "Current state", and "Next steps" sections of the handoff.
Boundary markers: The skill uses Markdown structured formatting (headers and bulleted lists) to delimit sections in the generated output, but it does not include explicit "ignore embedded instructions" warnings for the agent reading the file.
Capability inventory: The skill performs file-write operations to the .handoff/ directory or a user-specified path using the agent's file system tools (SKILL.md Workflow Step 6). It also suggests the use of the git tool to modify .gitignore or commit files.
Sanitization: The skill includes specific steps to redact sensitive information such as API keys, passwords, and PII (SKILL.md Workflow Step 4). However, it does not provide sanitization or filtering for natural language instructions in the "Locked decisions" or "Next steps" sections. It specifically instructs the resuming agent to treat "Locked decisions" as settled and not reopen them, which could lead to an agent following injected instructions without re-evaluation.

session-handoff