wrap-up
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill facilitates the ingestion of untrusted external data into the agent's persistent memory, creating an indirect prompt injection surface.\n
- Ingestion points: The agent reads from the current conversation history, git status, and git diff outputs to generate handoff reports.\n
- Boundary markers: There are no defined delimiters or instructions to ignore potential commands embedded within the ingested workspace data or git logs.\n
- Capability inventory: The skill is capable of reading and writing local project files (.claude/handoff.md, MEMORY.md, .claude/instincts.md) and executing git tools.\n
- Sanitization: No sanitization or content filtering is performed on the extracted session data before it is persisted in the project's durable storage.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to inspect the project state.\n
- Evidence: The workflow explicitly relies on git status and git diff to identify session changes and files touched.
Audit Metadata