The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests external conversation transcripts from Claude Code, Codex, and T3 Code. These transcripts are historical data that could contain malicious instructions designed to influence the agent's behavior once the session is resumed.
Ingestion points: The scripts/session-handoff.mjs script reads JSONL transcript files from user configuration directories (e.g., ~/.claude*, ~/.codex*), and scripts/t3-identity.mjs reads a SQLite state database.
Boundary markers: The instructions do not define explicit boundary markers or "ignore" instructions for the ingested transcript content, though they do advise the agent to separate facts from inferences.
Capability inventory: The skill possesses the ability to execute shell commands (via spawnSync for find and sqlite3) and read files throughout the user's home directory.
Sanitization: The instructions include a specific requirement to redact credentials and secrets with [redacted] before showing or persisting them.
[COMMAND_EXECUTION]: The helper scripts execute system commands using node:child_process.spawnSync to interact with the filesystem (find) and query databases (sqlite3).
Evidence: scripts/session-handoff.mjs uses find to discover configuration directories and transcript files. scripts/t3-identity.mjs uses sqlite3 to query the T3 Code state database. While inputs like session IDs are validated against regex patterns and the SQL query uses hexadecimal encoding for the thread ID to prevent injection, the skill remains dependent on the presence and behavior of these system utilities.

move-session-here