The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill generates a new agent prompt based on the current conversation history, which creates a surface for indirect prompt injection where malicious instructions from processed data could affect the subsequent agent session.
Ingestion points: Current conversation history is summarized for the new agent as defined in SKILL.md.
Boundary markers: The skill does not define or require prompt boundaries in the generated summary.
Capability inventory: The skill uses shell command execution to launch new agents and manage files.
Sanitization: Instructions suggest redacting secrets, but this relies entirely on model compliance.
[COMMAND_EXECUTION]: The skill relies on shell command execution for its primary functionality.
Evidence: SKILL.md specifies the use of mktemp, cat, and claude --bg to handle the transition between agents.
[DATA_EXFILTRATION]: Conversation content is written to temporary storage and passed through command-line arguments, creating a risk of local data exposure.
Evidence: Passing conversation summaries to a new process via command-line arguments ($(cat <summary file>)) can expose that data to other local users or processes through process monitoring tools like ps.

claude-handoff