handoff-to-claude-code
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted local data from the project tree (HTML prototypes, component files, and referenced assets) to generate a detailed technical specification in a README.md file. This creates a surface for indirect prompt injection where malicious instructions embedded in design files (e.g., within HTML comments or metadata) could influence the agent's documentation process or subsequent implementation steps.
- Ingestion points: The skill reads all relevant HTML prototypes, component files, images, fonts, and referenced assets from the local filesystem as described in SKILL.md.
- Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the processed files.
- Capability inventory: The skill performs file system reads (copying assets), file system writes (creating folders and the README), and file compression (zipping the handoff package).
- Sanitization: No sanitization or validation of the content within the design files is performed before they are documented in the README.
Audit Metadata