session-handoff
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from potentially untrusted external sources, which could contain hidden instructions.
- Ingestion points: The skill reads handoff notes from previous sessions, repository documentation (CLAUDE.md), and GitHub Pull Request comments (via
gh pr view). - Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when reading these sources, though agents are told to treat inherited claims as unverified.
- Capability inventory: The skill utilizes
BashandReadtools to inspect system state and files, which could be misused if the agent follows instructions found in external data. - Sanitization: While the skill mandates redacting secrets from its output, it lacks specific sanitization logic for data consumed from PR comments or handoff logs.
Audit Metadata