handoff
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
gitandghCLI tools to gather repository and PR metadata. This is part of the skill's intended operation.\n- [PROMPT_INJECTION]: The skill exhibits vulnerability to indirect prompt injection by ingesting and persisting untrusted data.\n - Ingestion points: The skill reads external data from
git log(commit messages) andgh pr list(PR titles/descriptions) inSKILL.md.\n - Boundary markers: The markdown handoff template lacks secure delimiters or instructions for the agent to ignore instructions found within the gathered text.\n
- Capability inventory: The skill writes to the local filesystem (
.codewhale/handoff.md), and this file is automatically loaded as a relay block in subsequent sessions, creating a persistence path for injected instructions.\n - Sanitization: No sanitization or validation is applied to the data retrieved from external tools before it is included in the handoff artifact.
Audit Metadata