The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to define a process for producing and consuming handoff documents (e.g., handoff-template.md), which constitutes an attack surface where malicious instructions could be embedded in the state data to influence the consuming agent's behavior.
Ingestion points: The 'Consume a handoff' section in SKILL.md explicitly instructs the agent to read and act upon data provided in handoff files.
Boundary markers: The instructions recommend separating facts from inferences and marking history sections, which acts as a weak delimiter, but there is no strict schema enforcement or escaping of the content.
Capability inventory: The skill is intended to be used in environments with significant capabilities, including repository management, file system modification, and command execution, as noted in the 'Verified evidence' and 'External effects' sections of the template.
Sanitization: The skill provides defensive instructions requiring the consumer to independently verify evidence against the filesystem and confirm that requested actions are still authorized, which serves as a mitigation strategy.

cross-agent-handoff