The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill manages a .docs/handoff.md file designed to provide context for subsequent agent sessions. This file includes a "Resume checklist" that explicitly directs the agent to "Re-run the last recorded validation command". Since these commands are extracted from potentially untrusted local markers (.docs/handoff.last-validation) or parsed from the existing handoff file and written back without sanitization, a malicious actor could inject shell commands into the project structure that a future agent might automatically execute.
Ingestion points: scripts/handoff.py reads untrusted data from project-local files including .docs/handoff.last-validation, .docs/handoff.session, and the previous content of .docs/handoff.md.
Boundary markers: The skill uses standard Markdown headings but lacks specific delimiters or system-level instructions to the agent to treat the captured validation commands as untrusted data.
Capability inventory: The utility script scripts/handoff.py uses subprocess.run for Git operations. The AI agent itself has broad tool-execution capabilities and is prompted by the skill's output to perform further shell executions.
Sanitization: No sanitization, escaping, or verification of the extracted command strings is performed before they are persisted in the markdown output.
[COMMAND_EXECUTION]: The script scripts/handoff.py utilizes subprocess.run to interact with the local git binary. While the specific arguments passed to git within the script are hardcoded and do not utilize shell=True, the skill's operational model is built around capturing and suggesting the execution of arbitrary shell commands (e.g., test runners and linters) from the project environment.

handoff