The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes session data from session.json, which could be provided by untrusted sources (e.g., in a cloned repository). This file contains fields like objective, status, and next_action that define the agent's understanding of the task flow.
Ingestion points: scripts/session.py loads and parses the session.json file in the load and mutate functions.
Boundary markers: The skill validates the JSON schema and version, but does not provide explicit markers to prevent the agent from following instructions embedded in the session's natural language fields.
Capability inventory: The skill has the ability to write files, manage locks, and execute Git commands via subprocess.
Sanitization: While the script validates field types and status enums, it does not sanitize the content of descriptive fields that are subsequently read by the agent.
[COMMAND_EXECUTION]: The skill uses the subprocess module to interact with the system's git binary.
Evidence: The run_git function in scripts/session.py invokes git with arguments such as head, worktree, and baseline which are retrieved from the session snapshot.
Mitigation: Command execution is performed using a list of arguments without a shell (shell=False), which effectively prevents standard shell injection attacks. The commands are restricted to the git utility.

spine-session