The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from local markdown archives which creates a vulnerability surface for indirect prompt injection.
Ingestion points: The skill reads markdown files from the .xy/sessions/ directory (or a custom root specified in .xy/config.json) as detailed in the 'Step 3: Read File' and 'Step 4: Display' sections of SKILL.md.
Boundary markers: No specific delimiters or 'ignore instructions' warnings are implemented when reading and displaying the archive content to the agent or the user.
Capability inventory: The skill can route the agent to a different skill defined in the next_skill field of the archive (Step 5A) and performs local file read/directory listing operations (Step 2 and 3).
Sanitization: The skill filters out technical metadata fields (e.g., slug, sessions) from user-facing output but does not perform sanitization, escaping, or validation of the text blocks (e.g., 'Conclusion', 'Assumptions') before they are interpolated into the prompt or passed to the next skill in the chain.
[COMMAND_EXECUTION]: The skill implements a command-line style interface (/xy-resume, /xy-resume list, /xy-resume --slug) that triggers file system operations. While these are intended for session management, the logic relies on parsing user-supplied arguments to determine file paths and search criteria.
[DATA_EXPOSURE]: The skill is designed to read and display diagnostic data from the local file system. It implements a security check in the 'Project Name and Archive Root Directory' section of SKILL.md that explicitly rejects sensitive paths such as the root directory (/), user home directory, or project root to mitigate accidental exposure of system files.

xy-resume