The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to capture context from the current conversation and 'preserve every active user instruction exactly' into a handoff document (SKILL.md, Step 2). This creates a vector for indirect prompt injection, where malicious instructions provided by a user (or embedded in processed data) are passed to the next agent session.
Ingestion points: The skill reads the 'current conversation' and extracts 'active user instructions' (SKILL.md, steps 1 and 2).
Boundary markers: The instructions are placed inside a Markdown blockquote (>) section labeled '## Active user instructions, verbatim' in the template (assets/handoff.md).
Capability inventory: The skill can read/write files and execute a specific shell script ../fast-track-ai-init/scripts/fast-track-ai-index.sh (SKILL.md, steps 1, 6, 8, and 9).
Sanitization: The skill explicitly avoids paraphrasing or modifying user instructions (SKILL.md, Step 2), though it mentions omitting secrets. There is no sanitization to prevent the injection of instructions that could influence the next agent.
[COMMAND_EXECUTION]: The skill executes a shell script using a relative path to a sibling directory (../fast-track-ai-init/scripts/fast-track-ai-index.sh) (SKILL.md, Step 9). While this script appears to be part of the same project ecosystem ('fast-track-ai'), executing scripts via relative paths outside the current repository root relies on the state of the parent environment.
[DATA_EXPOSURE]: The skill reads from fast-track-ai/INDEX.md and conversation history. While this is necessary for its stated purpose, it is a broad read capability that ingests sensitive context for storage in a handoff file.

fast-track-ai-handoff