handover
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from project files to generate instructions that influence subsequent agent sessions.
- Ingestion points: The skill reads content from multiple external files including
notes.md,plan.toml,phase-NN.md,design.md, and other unspecified 'governing artifacts'. - Boundary markers: Absent. The instructions do not provide delimiters or guidance to the agent to ignore potentially malicious instructions embedded within the ingested artifacts.
- Capability inventory: The skill writes to
handover.md(which serves as the initial context for the next agent) and executes environment-specific commands such as/harvest,/route, anddoctrine slice. - Sanitization: Absent. Data from the ingested files, such as 'open ids' and status updates, is interpolated directly into the continuation prompts and the handover packet without filtering or escaping.
Audit Metadata