The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to resume work from user-provided prompts, creating an indirect prompt injection surface. However, the instructions include robust defensive measures, such as prioritizing the repository's ground truth over the content of the prompt.
Ingestion points: User-pasted continuation prompts and the docs/handoff-state.md file (SKILL.md).
Boundary markers: The skill uses specific markdown headers (# /handoff) and the > resume: directive to delimit handoff instructions.
Capability inventory: The skill is capable of writing to the local filesystem (docs/handoff-state.md) and executing git commands (git status, git log, git worktree).
Sanitization: The instructions explicitly mandate that repo state beats the prompt on conflict and that the agent must verify the state against the repo before acting.
[COMMAND_EXECUTION]: The skill utilizes dynamic context injection to execute git status and git log commands at load time. These are benign development commands used to automatically populate the handoff state with repository context and do not represent a security risk.
[DATA_EXPOSURE]: The skill contains explicit safety guidelines to prevent credential leakage, instructing the agent that 'Secret values never go in; name where a credential lives instead.'

handoff