single-session-dev-flow
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONTIME_DELAYED_CONDITIONALINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command
check-plan --handoff <pack>using a local script located at../spec-and-plan/scripts/check-plan.mjs. This involves passing user-supplied or externally sourced data ('the pack') as an argument to a script execution. - [DYNAMIC_EXECUTION]: The skill requires the execution of a JavaScript module (
.mjs) file at runtime to validate handoff packages. - [TIME_DELAYED_CONDITIONAL]: The instructions include logic for periodic autonomous behavior, specifically 'top-level reviews' every 45 to 60 minutes and 'nighttime' execution sessions where the agent is authorized to perform tasks without immediate human intervention.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process 'handoff packs' (
交接信息包) and external documentation which may contain untrusted content. - Ingestion points: Reads handoff data from standard input or specific file paths (
../pass-the-baton/handoff-pack-template.md). - Boundary markers: Mentions a 'handoff checkpoint list' for structure, but lacks specific character-based delimiters to isolate untrusted instructions.
- Capability inventory: Execution of shell scripts, writing to local task files (
todo.md), and loading other nested skills. - Sanitization: No specific sanitization or escaping of the input pack data is described in the workflow instructions.
Audit Metadata