The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it restores workflow context, including natural language notes and decisions, from local JSON and TOON state files.
Ingestion points: The skill reads workflow state from .claude/logs/workflows/[workflow-id]/workflow-state.json and .claude/workflow-state.toon (SKILL.md).
Boundary markers: There are no defined delimiters or instructions to the agent to disregard potential instructions embedded within the loaded state data (e.g., in the notes or key_decisions fields).
Capability inventory: The skill utilizes Read, Write, and Bash tools to manage state files and project deliverables.
Sanitization: The skill performs JSON validation and version compatibility checks, but it does not implement sanitization or filtering for the natural language content stored within the state files.

session-continuation