design-handoff
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill frontmatter employs dynamic context injection to execute
git branch --show-current. This is a read-only, informational command that does not ingest user-supplied arguments, posing no execution risk. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads untrusted content from
design-threads.mdand incorporates it into a handoff summary for future agent sessions. - Ingestion points: The skill reads
design-threads.mdfrom the topic's design directory as specified in SKILL.md. - Boundary markers: The instructions do not define delimiters or 'ignore embedded instructions' warnings for the processed artifact content.
- Capability inventory: The skill uses file-reading and shell execution (
bash) for context, but does not specify tools for network access or persistence. - Sanitization: The skill lacks logic to sanitize or validate the content of the markdown files before including them in the emitted handoff summary.
Audit Metadata