The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The core mechanism involves creating a handoff document that a successor session is instructed to read and follow. This creates a surface for indirect prompt injection where malicious instructions could be embedded in data captured from the predecessor's environment (such as tool outputs or commit messages) and subsequently executed by the successor session. * Ingestion points: The successor session is instructed to read the handoff file at a path like .session/handoffs/-handoff-NN.md (specified in SKILL.md and references/successor-launch.md). * Boundary markers: Absent; the provided templates (templates/handoff.md) lack delimiters or explicit instructions to ignore potentially malicious embedded prompts within captured data sections like 'Gotchas' or 'Live state'. * Capability inventory: The successor session has access to terminal execution, file system operations, and session orchestration tools. * Sanitization: Absent; the capture contract in references/capture-contract.md mandates verbatim copying of identifiers and measurements without sanitization filters.
[COMMAND_EXECUTION]: The skill requires the agent to dynamically generate and execute a shell command to spawn a successor session. * Evidence: references/successor-launch.md instructs the agent to 'create one terminal in the active worktree whose command is the harness's own launch line'. This involves assembling command strings and prompts that are passed directly to the shell or orchestration runtime.

session-handoff