The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to read a handoff markdown file from a previous session and treat its contents as the primary agenda and next actions. This creates an attack surface where a malicious or compromised handoff file could inject instructions that the agent would then follow in a subsequent session.
Ingestion points: SKILL.md (Step 2) instructs the agent to read the entire handoff file from ~/.agent/handoffs/ at the start of a session.
Boundary markers: No boundary markers or 'ignore' instructions are used. The agent is explicitly told to 'Treat Next step as the default first action and Open threads as the agenda'.
Capability inventory: The skill allows file system read and write operations within the designated handoff directory and encourages the execution of commands found within the processed file.
Sanitization: There is no evidence of sanitization or validation of the file content before it is processed as instructions.
[COMMAND_EXECUTION]: The skill uses shell commands (printf) to construct paths based on environment variables and instructions to execute commands retrieved from external (handoff) files.

memory-handoff