handoff
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute git operations (rev-parse, log, status, diff, commit) and manage local files. These operations are core to the skill's purpose of synchronizing session data and state. The agent interpolates variables such as file paths, timestamps, and AI-generated summaries into these shell commands.
- [PROMPT_INJECTION]: The skill ingests untrusted data from git logs and conversation history to synthesize session artifacts and project status. This established an indirect prompt injection surface where malicious content in git history could theoretically influence the agent's summary generation or tool usage.
- Ingestion points: Data is pulled from git log outputs and user conversation history in Step 2 and Step 3.
- Boundary markers: The instructions do not specify explicit delimiters to separate external data from system instructions during processing.
- Capability inventory: The skill has access to shell execution via Bash and memory persistence via the MCP capture tool.
- Sanitization: The instructions provide structural constraints (e.g., kebab-case slugs and specific markdown headers) that limit the scope of the generated output.
Audit Metadata