handoff
Fail
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection through its session resumption mechanism.
- Ingestion points: The Resume mode reads context from ./HANDOFF.md.
- Boundary markers: The instructions lack delimiters or warnings to treat file content as untrusted.
- Capability inventory: The agent is empowered to execute shell commands (git, verify commands) and modify files.
- Sanitization: Data from the previous session is not sanitized before being loaded into the fresh session.
- [COMMAND_EXECUTION]: The agent is instructed to run arbitrary shell commands retrieved from a data file.
- Evidence: Step 3 of the Resume mode instructions says: Run the verify commands from the handoff.
- Risk: Any malicious input captured during the Write mode session can be placed into the Verify Commands section of HANDOFF.md and executed automatically when the session is resumed.
Recommendations
- AI detected serious security threats
Audit Metadata