frontend-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands, specifically
git diffandgit log, using arguments provided by the user (such as branch names or PR paths). This interpolation of user input into shell commands creates a potential surface for command injection. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the local repository to generate its output, which is a standard surface for indirect prompt injection.
- Ingestion points: The agent is directed to read
spec.md, ticket documentation intickets/*.md, repository context files likeCONTEXT.mdandCLAUDE.md, and the source code itself. - Boundary markers: No specific delimiters or "ignore" instructions are provided to help the agent distinguish between its instructions and the content of the files it reads.
- Capability inventory: The skill has the capability to read local files, execute git commands, and write files to the
.scratch/directory. - Sanitization: The skill does not implement any validation or sanitization of the content read from files or the arguments provided by the user.
Audit Metadata