handoff
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from workspace files, such as implementation plans and pull requests, to generate handoff summaries.
- Ingestion points: Workspace artifacts and file paths cited in references/output.md and references/pack.md.
- Boundary markers: The output templates use Markdown fenced code blocks to separate handoff data, but the instructions do not specify sanitization or escaping of the ingested content.
- Capability inventory: The skill can spawn subagents (handoff-subagent-dispatch.md) and perform local filesystem writes (SKILL.md).
- Sanitization: Instructions in SKILL.md and references/research-basis.md mandate the redaction of secrets, tokens, and PII, although they do not explicitly filter for malicious instructions within the summarized content.
- [COMMAND_EXECUTION]: The skill directs subagents to execute shell-like commands to prepare the filesystem for handoff artifacts.
- Evidence: The handoff-subagent-dispatch.md file includes instructions for the subagent to perform mkdir -p and write files to the local _agent/handoffs/ directory.
- [EXTERNAL_DOWNLOADS]: The skill references external documentation for configuration and shared vocabulary.
- Evidence: SKILL.md and references/pack.md link to a context configuration file hosted at https://raw.githubusercontent.com/csark0812/toolbox/main/council/references/context-pack.md. This resource originates from the skill author's repository.
Audit Metadata