The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill generates a handoff document intended to guide the behavior of subsequent agents, establishing a multi-step execution chain that can be manipulated.
Ingestion points: The skill ingests the entire "current conversation" (SKILL.md), which contains untrusted input from the user and external data sources.
Boundary markers: There are no defined boundary markers or explicit instructions provided to the receiving agent to treat the summary or the "suggested skills" section as untrusted data.
Capability inventory: The skill utilizes file system write capabilities to save the document to the operating system's temporary directory.
Sanitization: The skill explicitly requires redacting sensitive information (API keys, passwords, PII), but it lacks mechanisms to sanitize or filter potentially malicious natural language instructions that could influence the next agent's actions through the "suggested skills" section.
[COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations outside of the established workspace environment.
Evidence: The instruction specifies: "Save to the temporary directory of the user's OS
not the current workspace." (SKILL.md). While often used for transient data, writing outside the workspace can bypass workspace-specific monitoring or lead to accidental data exposure depending on system permissions.

handoff