pickup
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process instructions from external Markdown files located in the .planning/handoffs/ directory. 1. Ingestion points: Local files in .planning/handoffs/ mentioned in SKILL.md. 2. Boundary markers: The skill instructions do not provide delimiters or warnings to ignore potentially malicious embedded commands in the handoff files. 3. Capability inventory: The agent can list files via shell (ls), read local files, and is directed to proceed with steps described in the handoff content. 4. Sanitization: No sanitization or validation of the handoff file content is specified.
- [COMMAND_EXECUTION]: The skill uses the ls -la command to browse the filesystem for available handoff sessions.
Audit Metadata