The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes the current conversation history to generate its output, which presents a surface for indirect prompt injection if the chat contains malicious instructions.
Ingestion points: The agent is instructed to reread the entire session conversation (SKILL.md, Procedure step 1).
Boundary markers: No specific delimiters or boundary markers are defined for the input text, although a structured output schema is provided.
Capability inventory: The skill uses Write to save markdown files to the docs/handoffs/ directory and Bash to execute git commands.
Sanitization: The skill includes a mandatory redaction step (SKILL.md, Procedure step 5) to remove API keys, tokens, passwords, and PII before outputting the document.
[COMMAND_EXECUTION]: The skill executes hardcoded git commands via Bash to retrieve workspace metadata such as branch names, commit hashes, and status. These are limited to read-only queries of the repository state.
[CREDENTIALS_UNSAFE]: While the skill interacts with environments that may contain sensitive information (like .env files or workspace history), it explicitly forbids the inclusion of secrets in the generated output, requiring them to be referenced by name rather than value.

handoffkit