The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's architecture relies on the agent reading and following instructions from Markdown documents stored in the .claude/handoffs/ directory. This creates an attack surface where malicious instructions could be placed in these files to influence future agent behavior.\n
Ingestion points: The RESUME Workflow in SKILL.md requires the agent to read handoff documents completely. The scripts/check_staleness.py and scripts/validate_handoff.py scripts also process these files as inputs.\n
Boundary markers: There are no technical boundaries, delimiters, or sanitization steps used to distinguish between legitimate context and potential malicious prompt injections within the handoff Markdown.\n
Capability inventory: The skill has the capability to execute shell commands via subprocess.run (primarily for git) and perform filesystem operations, which could be abused if an injected prompt tricks the agent into misusing these tools.\n
Sanitization: The skill provides a scripts/validate_handoff.py script that proactively scans for secrets and TODOs to improve handoff safety and quality.\n- [COMMAND_EXECUTION]: Multiple scripts (scripts/create_handoff.py, scripts/check_staleness.py, and evals/setup_test_env.py) use the subprocess module to execute git commands. While currently restricted to git operations and using list-based arguments without a shell, this functionality provides a bridge to system command execution. The scripts/create_handoff.py script includes a basic sanitization step for the slug input to prevent simple injection or path traversal attempts.

session-handoff