The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements an automated context injection mechanism that reads data from the file system, creating a potential attack surface.
Ingestion points: The hooks/session-start.sh script scans the .handoffs/ directory and reads the content of the most recently modified markdown file.
Boundary markers: The script wraps the file content with a '--- handoff contents ---' header but lacks specific defensive instructions to prevent the agent from executing instructions found within the file.
Capability inventory: The agent environment (Claude Code, etc.) has extensive capabilities including file modification and command execution, which could be leveraged if the handoff content is malicious.
Sanitization: No content validation or sanitization is performed on the handoff files before injection.
[COMMAND_EXECUTION]: The skill relies on shell scripts and embedded Python to perform its tasks.
hooks/session-start.sh executes shell commands and an embedded Python script to process file metadata and content.
hooks/pre-compact.sh runs as a shell command to provide prompts during context compaction.
[PERSISTENCE]: The installation process involves permanent modifications to user and agent configuration files.
Recommends adding hooks to ~/.claude/settings.json to automate skill execution across sessions.
Recommends modifying global Git configuration using git config --global core.excludesfile to ensure persistent behavior across repositories.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the skill from a remote repository using the npx skills add justin/jww-skills command, which downloads the skill code from an external registry.

jww-handoff