The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The protocol ingests session state data from local files, creating a theoretical surface for indirect prompt injection. This is heavily mitigated by several design factors.
Ingestion points: Reads session state from .moru/runs/continuation.json as specified in the packet contract.
Boundary markers: Utilizes a strict Version 1 JSON schema with additionalProperties set to false and limited nesting depth.
Capability inventory: The skill uses file system access to the project's .moru directory and executes git commands for integrity checks.
Sanitization: Enforces rigorous limits on prose fields (e.g., 280-character objectives) and a 4 KiB aggregate prose limit to prevent injection of malicious payloads.
[COMMAND_EXECUTION]: The skill performs local command execution to verify project state and manage run ownership.
Evidence: Executes git commands to perform drift verification and state fingerprinting against the worktree.
Evidence: Calls the moru-hook CLI and internal management scripts like agent_run_owner.py.
[PERSISTENCE]: This skill provides legitimate session persistence across agent turn interruptions.
Evidence: Stores state in the project-local .moru directory.
Security controls: Explicitly implements outbound deny rules and never-sync boundaries to prevent session state from being uploaded to Git or sent through outbound telemetry or export paths.

session-continuation-protocol