The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill instructs the agent to save a context handover file to the operating system's temporary directory, which is outside the workspace. It also requires posting this content to a GitHub issue or pull request. While there are instructions to redact secrets and PII, the movement of session data to an external platform is a documented behavior.
[INDIRECT_PROMPT_INJECTION]: The skill processes the entire conversation history to generate summaries. This creates an attack surface where malicious instructions present in the input data could be included in the handover document and subsequently executed or obeyed by the next agent session. Evidence Chain: 1. Ingestion points: Full conversation history, plan files, task lists, background process IDs, and modified files (SKILL.md). 2. Boundary markers: The template uses headers, but lacks explicit "ignore embedded instructions" warnings for the content being summarized. 3. Capability inventory: Tool calls to write to the local filesystem and the GitHub API/CLI. 4. Sanitization: Instructions to redact secrets, API keys, and PII are present.
[COMMAND_EXECUTION]: The skill requires the agent to interact with GitHub to post comments and manage labels like paused by agent. This involves the execution of shell commands or API-based tools.

handover