verified-delivery
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFE
Full Analysis
- [PERSISTENCE]: The skill implements task state persistence by writing to a local machine-readable file named
.verified-delivery/handoff.json. This is a functional requirement that allows the agent to maintain state across different sessions or context resets for a specific delivery task. - [INDIRECT_PROMPT_INJECTION]: The skill describes an attack surface where instructions are resumed from external data (the handoff file or PR description). The implementation includes the following safeguards:
- Ingestion points: Data is read from the
.verified-delivery/handoff.jsonfile and machine-readable blocks in Pull Request descriptions. - Boundary markers: Resumption is gated by the presence of the
verified-delivery/handoff-v1schema identifier and an 'open' status. - Capability inventory: The skill utilizes file-writing operations for handoff management and standard development tools (git, GitHub CLI) for repository mutations.
- Sanitization: The agent is required to perform mandatory read-only live-state verification—comparing repository remotes, PR identifiers, and branch head SHAs—and must explicitly confirm the authorization boundary with the user before any mutations occur on resumption.
- [DATA_EXPOSURE]: The skill provides an option to store task metadata and verbatim user directives in PR descriptions on shared forges. This could expose internal workflow details to other users. This risk is mitigated by an explicit instruction to confirm the target, disclosed scope, and rollback path with the user before writing any such data externally.
Audit Metadata