The Agent Skills Directory

[COMMAND_EXECUTION]: The restore mode parses the .claude/handoff.md file and executes shell commands found in the Verification block. The instructions command the agent "Do not skip this," leading to the execution of potentially arbitrary shell commands before the user has a chance to review them.
[DYNAMIC_EXECUTION]: The skill relies on runtime execution of commands retrieved from data (the handoff file). Since the contents of this file are meant to be updated across sessions, a compromised or maliciously crafted handoff file could result in unauthorized code execution.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect injection. 1. Ingestion points: Reads .claude/handoff.md during the restore process. 2. Boundary markers: The skill lacks any delimiters or instructions to treat the command block as potentially untrusted data. 3. Capability inventory: The skill uses subprocess execution to run the verification commands extracted from the handoff file. 4. Sanitization: There is no evidence of command sanitization, filtering, or validation before execution.

handoff