The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions include techniques to bypass security filters. Specifically, Step 5 advises the agent to split git commands into individual calls to evade 'deny rules' that might block a single call containing multiple commands.
[COMMAND_EXECUTION]: The skill directs the agent to execute various shell commands, including git for worktree management, committing, and pushing changes. It also executes user-defined environment tools like <worktree-tool>, <session-host>, and <agent> to manage and spawn new processes.
[DATA_EXFILTRATION]: The flow involves committing and pushing local repository state to a remote server via git push. While part of a legitimate developer workflow, this represents a network operation that transmits local data to an external location.
[INDIRECT_PROMPT_INJECTION]: The skill implements a handover mechanism where the current session writes instructions into a 'handoff' file which is then used to prompt a subsequent agent session. This creates a vulnerability surface where potentially malicious data from the current session can influence the next session's behavior.
Ingestion points: The 'handoff' file generated in Step 3 of SKILL.md.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the handoff file as untrusted data or to ignore embedded instructions.
Capability inventory: Git file operations (write, commit, push), process execution via <agent> (Step 7).
Sanitization: The instructions do not include any steps to sanitize, escape, or validate the content written to the handoff file before it is processed by the next agent.

handover