The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local handoff files to restore session context, which can lead to the agent adopting malicious instructions embedded in those files.
Ingestion points: The skill reads markdown files from the docs/handoffs/ directory and parses their content (frontmatter and body) to restore the session state.
Boundary markers: The instructions do not define clear boundaries or provide warnings to the agent to ignore potentially malicious embedded instructions within the handoff documents.
Capability inventory: The skill involves reading/writing files, moving files (archiving), and executing shell commands such as ls and git status based on the context found in the files.
Sanitization: There is no evidence of sanitization or validation of the handoff content before the agent processes the "Next Steps" or "Files to Read" sections, allowing content to influence the agent's future actions.

handoff-resume