The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to capture and persist conversation state, which involves processing untrusted data that is later re-introduced into the agent's context.
Ingestion points: SKILL.md (Step 1: Read user's words via the turns command) and references/work-graph.md (the import command which loads external JSON bundles).
Boundary markers: Present. The skill uses structured Markdown projections with defined headers (## Notes, ## Directives, ## Identifiers) as described in the "Handoff slug" section of SKILL.md to separate different types of state.
Capability inventory: SKILL.md (Runtime commands) and references/commands.md document extensive file read/write and script execution capabilities via wheypoint.pyz. references/parallel-handoffs.md further describes the ability to specify and execute arbitrary shell commands for task isolation.
Sanitization: Present. SKILL.md (What the runtime enforces) explicitly states that the runtime refuses text matching credential patterns. references/work-graph.md details digest verification for links and bundles to ensure data integrity.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute a bundled Python zipapp (wheypoint.pyz) with a wide array of subcommands to manage the checkpointing lifecycle. This includes operations for state validation, record forking, and data import/export.
[DATA_EXFILTRATION]: To perform its handoff duties, the skill accesses potentially sensitive information, including conversation transcripts, local file system paths (e.g., xdg: and absolute paths), and Git repository metadata. While this is necessary for the skill's purpose, it represents a data exposure surface if the state records are shared or exfiltrated via the export command.

wheypoint