handover
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads project files like notes.md and plan.toml to generate instructions for the next agent session.
- Ingestion points: The agent reads state phase records, notes.md, and plan.toml to build context.
- Boundary markers: The skill does not provide instructions to use delimiters or ignore-instructions markers when embedding this content into handover.md.
- Capability inventory: The skill involves reading local files, writing a new instruction file (handover.md), and executing project-specific CLI tools.
- Sanitization: No validation or escaping of ingested content is performed before it is re-emitted as guidance for the next session.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific CLI tools including 'slice verify-vt' and 'doctrine slice phase' to verify status and transition workflows. These appear to be expected project-specific operations.
Audit Metadata