The Agent Skills Directory

[COMMAND_EXECUTION]: The logic for determining the output filename in Step 7 processes the $ARGUMENTS variable within a shell script context. While it includes some sanitization for 'bare' filenames, the path-processing branch (triggered by slashes or tildes) does not adequately escape the input. If the agent executes this logic as a shell script, a maliciously crafted argument containing shell metacharacters could lead to arbitrary command execution.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted data from the execution environment, including git commit messages, branch names, and file statuses, and interpolates them into a Markdown file without sanitization or boundary markers. Because the stated purpose of the skill is to provide context for the agent to read and follow in future sessions, malicious instructions embedded in a commit message or file could be used to influence the agent's behavior during the 'resume' phase.
Ingestion points: git log (commit messages), git branch (branch names), git status (file lists), and user input via AskUserQuestion.
Boundary markers: Absent; data is interpolated directly into Markdown sections.
Capability inventory: The agent has access to Bash and Write tools, providing a significant impact surface if the agent obeys instructions found within the handoff file.
Sanitization: Filename sanitization exists for simple strings, but no sanitization is performed on the content gathered from the repository state.

handoff