The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. It takes user-supplied arguments and conversation history—which could contain malicious instructions—and incorporates them into a handoff document designed to be read by another agent. This creates a multi-step chain where an attacker could influence subsequent agent behavior.
Ingestion points: User arguments and conversation history mentioned in SKILL.md.
Boundary markers: Absent; there are no instructions to use delimiters or treat the summarized content as untrusted data.
Capability inventory: The agent has the ability to write to the file system.
Sanitization: Absent; the skill does not specify any filtering or escaping of the ingested content.
[COMMAND_EXECUTION]: The skill requires the execution of the mktemp shell utility to generate a temporary file path. While mktemp is a standard tool, the reliance on shell execution to determine file paths introduces a dependency on the underlying system's command environment.
[DATA_EXFILTRATION]: The instructions explicitly direct the agent to read the file path produced by mktemp before writing to it. While this may be intended as a check, reading arbitrary paths generated by external utilities can lead to unintentional data exposure if the path resolution is manipulated to point to sensitive files.

handoff