handoff
Pass
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
bd synccommand to synchronize task states when a.beads/directory is present in the workspace. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and summarizes session history to create persistent handoff and lesson files.
- Ingestion points: Session history, active file content, and conversation context are analyzed to generate documentation (SKILL.md).
- Boundary markers: The skill uses Markdown templates to structure the handoff document, but it does not include explicit instructions to ignore or escape malicious commands embedded within the session data being summarized.
- Capability inventory: The skill has the ability to write files to the local file system (
thoughts/shared/handoffs/anddocs/instructions/learned/) and execute thebd synccommand. - Sanitization: There is no evidence of sanitization, validation, or escaping of external or session-provided content before it is interpolated into the generated documents.
Audit Metadata