The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a shell command mkdir -p .agents in SKILL.md to ensure the directory for session logs exists. This is a benign operation required for its basic functionality.
[INDIRECT_PROMPT_INJECTION]: The skill provides a mechanism to reload session state from a local file (session_ledger.md), which constitutes an attack surface if the file content is modified by an untrusted source.
Ingestion points: The agent reads the .agents/session_ledger.md file during the "Post-Clear Recovery Protocol" described in SKILL.md.
Boundary markers: There are no explicit markers or instruction delimiters used to separate reloaded session data from the agent's system instructions.
Capability inventory: The skill utilizes Read and Write tools to interact with project files and executes simple shell commands (mkdir).
Sanitization: No sanitization, escaping, or schema validation is mentioned for the markdown content read from the ledger file.

session-checkpoint