pic-handoff
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill interpolates untrusted user data into instructions for AI subagents, creating a surface for indirect prompt injection.
- Ingestion points: User-provided handoff notes via the
$ARGSvariable inSKILL.md. - Boundary markers: Absent. The notes are included in the subagent prompt in Step 9 without delimiters or instructions to the agent to treat the content as data rather than instructions.
- Capability inventory: The skill can spawn multiple types of subagents (Explore, planner, builder, test-writer, reviewer) via the Task tool. A malicious handoff note could potentially manipulate these subagents' behavior.
- Sanitization: Absent. The skill does not validate, escape, or filter the content of
$ARGSbefore writing it to files or including it in prompts.
Audit Metadata