multi-agent-handoff
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill implements a coordination protocol where multiple agents read from and write to shared markdown files (e.g., HANDOFF.md). This setup introduces an indirect prompt injection surface, as instructions embedded in the shared context by one agent could be used to manipulate the behavior of subsequent agents in the workflow.\n
- Ingestion points: Agents ingest data from HANDOFF.md and task issue descriptions as defined in the skill templates.\n
- Boundary markers: The framework uses markdown headers to organize information but lacks explicit boundary markers or instructions to disregard potentially malicious embedded commands within those fields.\n
- Capability inventory: The workflow permits agents to modify files within a defined write_set and execute arbitrary shell commands for verification and repository-native validation gates.\n
- Sanitization: No automated sanitization or validation logic is specified for the content passed between agents through the handoff files.\n- [COMMAND_EXECUTION]: The skill requires the execution of shell commands, including repository-native validation gates (e.g., pnpm run validate) and vendor-specific tools from the steward CLI suite for tasks such as schema checking and blocked input explanation.\n- [EXTERNAL_DOWNLOADS]: The skill provides installation instructions that use npx to fetch the arenukvern/skill_steward package from a remote registry. It also contains references to external documentation hosted on well-known platforms including GitHub, OpenAI, and Zed.
Audit Metadata