The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted or externally influenced sources, such as git logs and project markdown files, which are then interpolated into a handoff document for the AI to process in future sessions. This creates a surface where malicious content within a repository could attempt to influence the agent's behavior.
Ingestion points: The relay-collect.sh script reads git history, .claude/plan.md, and other local markdown files.
Boundary markers: The generated baton document utilizes markdown headers for organization but lacks specific adversarial delimiters or instructions for the agent to ignore embedded commands within the ingested data.
Capability inventory: The skill possesses Bash script execution capabilities and Read/Write access to the local file system.
Sanitization: The skill uses jq and python3 for structural JSON handling and performs basic whitespace cleaning and character replacement in the relay-build-focus.sh script.
[DYNAMIC_EXECUTION]: The relay-lib.sh library uses the eval command to execute logic defined in the RELAY_CLIPBOARD_CMD environment variable. While this is primarily intended for user-defined clipboard tools or testing, it represents a dynamic execution pattern that could be exploited if the environment is compromised.
[COMMAND_EXECUTION]: The skill relies on executing local bash scripts that perform system-level operations, including gathering system metadata (hostname, uname) and interacting with the git binary to extract project state information.

relay