The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to load project context from files in the workspace (specifically STATE.md, .continue-here, and PLAN files) to determine the "next action routing." This ingestion of untrusted data from the local environment creates a surface for indirect prompt injection.
Ingestion points: Loads and processes the contents of STATE.md, .continue-here, and project PLAN files to restore session context.
Boundary markers: There are no defined delimiters or instructions to treat the loaded file content as data rather than instructions, nor are there warnings for the agent to ignore embedded commands.
Capability inventory: The skill is granted access to high-privilege tools including Bash and Write, which could be abused if the agent inadvertently follows instructions embedded in the project state files.
Sanitization: The skill does not specify any sanitization, validation, or filtering of the content read from the workspace before it is used to route agent actions.

gsd-resume-work