The Agent Skills Directory

[PERSISTENCE]: The skill includes an optional configuration step that creates a directory at ~/.claude/hooks/continue-here and writes a bash script read-continuation.sh. It then modifies the user's ~/.claude/settings.json to register this script as a SessionStart hook, ensuring it executes automatically every time a new session begins.
[DYNAMIC_EXECUTION]: In Step 6, the skill dynamically generates a shell script at runtime using a heredoc and modifies its file permissions using chmod +x. This script is subsequently used by the platform to inject context into the agent.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform extensive file system operations, environment checks via git and stat, and to modify agent configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill establishes a significant surface for indirect prompt injection by design. It reads the contents of a CONTINUE_HERE.md file and injects them into the agent's active context. If this file contains malicious instructions from an external source or a compromised session, the agent may execute them.
Ingestion points: Manual reading of the handoff file in Step 1 and automated injection via the SessionStart hook in Step 6 (populating additionalContext).
Boundary markers: While the skill provides descriptive instructions to the agent in SKILL.md and CLAUDE.md, it does not employ strict delimiters or explicit 'ignore embedded instructions' warnings for the ingested file content.
Capability inventory: The skill has access to Read, Write, Bash, Grep, and Glob, which could be abused if the agent follows malicious instructions from the handoff file.
Sanitization: The skill performs character escaping for JSON compatibility but lacks any validation or sanitization of the actual content being injected into the session context.

read-continue-here