The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates an indirect prompt injection surface by instructing agents to treat natural language content from external files as verbatim instructions.
Ingestion points: The RESUME Workflow in SKILL.md instructs the agent to read files from .claude/handoffs/*.md, specifically noting that filled ans: fields should be treated as instructions for the session.
Boundary markers: The skill does not implement boundary markers or instructions to ignore potential injections within the handoff files.
Capability inventory: The skill has the ability to execute git commands and local scripts (create_handoff.py, validate_handoff.py) that interact with the file system.
Sanitization: The validate_handoff.py script checks for hardcoded secrets and placeholders but does not sanitize the content for malicious natural language instructions.
[COMMAND_EXECUTION]: The skill relies on local shell command execution for its core functionality.
scripts/create_handoff.py uses subprocess.run to call git for repository metadata. The input slug is sanitized to alphanumeric characters and dashes before being used in file operations.
SKILL.md directs the agent to manually execute ls, git log, git status, and git branch during the session resumption process.

session-handoff