handoff-codex
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by ingesting untrusted data from the conversation history and existing artifacts to create a continuation document for future sessions.
- Ingestion points: The skill processes user invocation text, conversation history, and inspected artifacts such as files, branches, commits, PRs, issues, and URLs (SKILL.md).
- Boundary markers: Absent. There are no instructions to use delimiters or to ignore embedded instructions within the processed data.
- Capability inventory: The skill performs file-writing operations to local session folders or OS temporary directories (SKILL.md).
- Sanitization: Although the skill explicitly mandates the redaction of API keys, passwords, and tokens, it lacks measures to sanitize or escape instructions that may be present in the source material.
Audit Metadata