task-state
Warn
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends installing an external extension from a third-party repository using
npx skills add mattpocock/skills --skill handoff, which involves downloading and executing code from an external source. - [EXTERNAL_DOWNLOADS]: The skill relies on code from a GitHub repository (
mattpocock/skills) that is not part of the trusted organization list. - [COMMAND_EXECUTION]: Instructions include the execution of shell commands (
npx) to download and install additional skills. - [PROMPT_INJECTION]: The skill processes untrusted data from repository files, presenting an indirect prompt injection risk.
- Ingestion points: The skill is designed to read existing repository artifacts such as issues, checklists, and roadmap entries.
- Boundary markers: No explicit markers or delimiters are defined to ensure the agent ignores instructions potentially embedded within these external files.
- Capability inventory: The skill has the capability to modify repository files and perform branch management tasks such as merging and deletion.
- Sanitization: Content read from external project trackers is not validated or sanitized before being processed.
Audit Metadata