resume-handoff

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon instructions contained within 'handoff' markdown documents located in thoughts/shared/handoffs/. These documents define 'Resume contracts' including next steps, re-arm tasks, and autonomy settings.
  • Ingestion points: The Read tool is used in references/process.md to load the full content of handoff files into the agent context.
  • Boundary markers: The skill lacks explicit delimiters or instructions to prevent the agent from being influenced by adversarial content within the handoff data.
  • Capability inventory: The agent is granted Bash, TodoWrite, and Read capabilities, which it uses to implement tasks, modify codebases, and interact with external CLI tools.
  • Sanitization: No validation or sanitization is performed on the content extracted from the handoff documents before the agent proceeds with implementation.
  • [COMMAND_EXECUTION]: The SKILL.md file executes a Bash script during the prerequisite check to discover handoff files. This script utilizes find, grep, and ls to locate files matching specific ticket ID patterns extracted from user arguments.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with the Linear issue tracker via the linearis CLI and performs data synchronization using humanlayer thoughts sync. These interactions are consistent with the skill's intended purpose of managing project tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 09:12 PM
Security Audit — agent-trust-hub — resume-handoff