handoff
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests data from external project files which serves as a potential surface for indirect prompt injection.
- Ingestion points: The skill reads from
../shared/cross-client-handoff.mdand other documentation files (CLAUDE.md,AGENTS.md) to determine its state. - Boundary markers: Absent; the agent is instructed to follow the schema and state machine within the external file without specific boundary delimiters.
- Capability inventory: The agent has the ability to write files to the project root and execute recorded commands.
- Sanitization: The instructions explicitly require the agent to validate content and ensure no secrets, credentials, or restricted data are included in the handoff state.
- [COMMAND_EXECUTION]: The instructions direct the agent to record and execute 'real commands' and 'documented client installer or sync commands' associated with the project distribution. While framed as a legitimate workflow, this involves the execution of shell commands sourced from project documentation.
Audit Metadata