handoff-spec
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to collect 'anything that lives only on this machine and the next session needs: unpushed branches, uncommitted work, scratch results worth keeping' and to 'push, so everything the spec points at exists on the remote.' This encourages the transfer of local state that may not have been vetted for secrets or sensitive information to a remote server.
- [COMMAND_EXECUTION]: The instruction to 'push' implies the execution of version control commands (e.g., git push) to modify a remote repository's state.
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to synthesize information from 'the discussion and from the work itself,' creating a surface for indirect prompt injection.
- Ingestion points: The agent reads from the conversation history and the repository's files (SKILL.md).
- Boundary markers: There are no instructions defining boundaries for untrusted content or markers to prevent the agent from obeying instructions embedded in the project files.
- Capability inventory: The agent has the capability to write to the local file system (modifying the spec) and perform network operations via repository pushing.
- Sanitization: No sanitization or filtering logic is specified for the information gathered from the discussion or work files.
Audit Metadata