find-handoff
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [DATA_EXFILTRATION]: Ingests sensitive session history from
~/.claude/projects/and.work/handoffs/, which contain records of past AI interactions, private code, and user-provided data. - [COMMAND_EXECUTION]: Uses shell commands (
ls,printenv,git) to gather context and employs dynamic context injection (!ls) inSKILL.mdto automatically list directory contents at skill load time, exposing local filesystem structure to the agent. - [PROMPT_INJECTION]: Operates on an indirect prompt injection surface by processing and re-executing instructions from untrusted transcript siblings; mitigations include bounded scans, mandatory user confirmation before resumption, and logic to filter out template-based false positives.
- [CREDENTIALS_UNSAFE]: Identifies and instructs the agent to sanitize git remote URLs containing embedded authentication tokens found in transcript metadata by stripping userinfo before presentation.
Audit Metadata