handoff
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by aggregating untrusted data from external sources and project files to generate instructions for subsequent agent sessions.
- Ingestion points: The skill reads local repository status files and external GitHub content, specifically pull request bodies and issue descriptions, using the
ghCLI tool. - Boundary markers: The instructions lack requirements for delimiters or 'ignore' markers to separate untrusted external content from the summarized instructions in the handoff document.
- Capability inventory: The skill performs file system writes to local repository paths and executes the
ghcommand-line tool. - Sanitization: The skill includes an explicit instruction to redact sensitive information (API keys, passwords, PII), which serves as a data protection control but does not prevent instruction injection.
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh pr viewandgh issue view) to programmatically fetch information about the current project state.
Audit Metadata