meisijiya-handoff
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns were identified. The skill follows security best practices for session state persistence and cross-session handoff.
- [DATA_EXFILTRATION]: The skill includes a proactive scanner that detects and redacts sensitive information such as API keys and tokens before they are written to the handoff document, ensuring private credentials do not persist across session boundaries.
- [PROMPT_INJECTION]: The skill enforces a 'user-driven' model by setting 'disable-model-invocation: true'. It requires explicit slash commands and verbatim confirmation for non-standard flows, preventing autonomous behavior. It also mitigates indirect prompt injection risks through a defined evidence chain: 1. Ingestion points: User input (argument-hint) and local project files (.omo/plans, .git/log, tool history); 2. Boundary markers: Structured YAML frontmatter and strict Markdown headers; 3. Capability inventory: Read, Bash, and Write tools; 4. Sanitization: Mandatory secret redaction and strict word count limits (200-300 words per section) with truncation to prevent context-based attacks.
- [COMMAND_EXECUTION]: Shell commands are restricted to basic validation utilities like 'test', 'grep', and 'wc' for file integrity and constraint checking. No dangerous command patterns or remote execution vectors were found.
Audit Metadata