The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The installation instructions recommend piping a remote shell script (install.sh) from raw.githubusercontent.com directly into the bash interpreter. This is a common but high-privilege pattern that requires the remote repository to be secure.
[EXTERNAL_DOWNLOADS]: The install.sh script uses curl to download additional components including SKILL.md, inject.md, and reference templates from the author's GitHub repository (wecansync/agent-skills). These resources are documented as originating from the tool's verified identity but constitute external data fetching at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill processes unverified local project files and documentation to build an agent context index. This surface could allow maliciously crafted documentation in a project to influence the agent's summary or behavior during handoff.
Ingestion points: Discovers and reads files like README.md, package.json, composer.json, and documentation located in docs/, specs/, or api/ directories (Step 2 and 3 of SKILL.md).
Boundary markers: There are no explicit markers or warnings used when writing content from these files into the .ai/ context directory to prevent the agent from following instructions embedded within the processed text.
Capability inventory: The skill uses file system read/write and shell execution (mkdir, find, git log).
Sanitization: The skill lacks explicit sanitization or escaping mechanisms for content extracted from third-party project files before it is stored in PROJECT.md or PATHS.md.
[COMMAND_EXECUTION]: Automated project discovery is performed using shell commands like find to locate documentation and git log to verify recent history for stale context detection. These operations occur within the project root directory.
[DYNAMIC_EXECUTION]: The skill generates and injects markdown-based instruction snippets into various agent configuration files (e.g., CLAUDE.md, .cursorrules). These snippets instruct current and future AI agents to prioritize reading the .ai/ context directory, establishing a persistent cross-session behavior control mechanism.

agent-handoff