The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly directs the agent to execute the mktemp shell command to generate file paths for storing conversation data.
[DATA_EXFILTRATION]: Summaries of the conversation—which often contain sensitive data, credentials, or PII—are written to the local filesystem in temporary storage locations (e.g., /tmp). This constitutes a local data exposure risk as these files may be accessible to other users or processes on the system.
[PROMPT_INJECTION]: The skill is instructed to 'read the file before you write to it' using a path generated by a shell command. This pattern is unusual for temporary files and could be exploited to read sensitive files if the path generation is compromised.
[PROMPT_INJECTION]: The skill processes untrusted conversation history to create a handoff document. This represents an indirect prompt injection surface where malicious instructions in the conversation could be 'carried over' to the next agent session.
Ingestion points: Conversation history and user arguments are ingested and summarized.
Boundary markers: No delimiters or 'ignore' instructions are provided to the agent to distinguish between data and instructions within the conversation history.
Capability inventory: The skill uses shell execution (mktemp) and filesystem read/write capabilities.
Sanitization: There is no evidence of input validation, sanitization, or escaping applied to the conversation content before it is written to the handoff file.

handoff