task-handoff
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local, bundled Bash script (scripts/task-handoff.sh) to handle the logic for plan preparation and finalization. The script includes defensive checks for directory ownership, permissions, and tool availability.- [COMMAND_EXECUTION]: The skill constructs codex CLI commands dynamically. It employs a shell_quote function that correctly escapes single quotes to prevent command injection vulnerabilities when the agent processes task descriptions or repository paths.- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests data from local Git repositories to generate task plans.
- Ingestion points: Repository-local instructions, implementation files, and working-tree state accessed via Git and file system tools.
- Boundary markers: Absent; the skill lacks explicit markers to differentiate between user instructions and data retrieved from analyzed repositories.
- Capability inventory: Writing plan files to the local file system (.ai/task-handoffs/), interacting with the system clipboard (pbcopy/pbpaste), and generating shell commands for user execution.
- Sanitization: Strict regex validation for generated filenames (^[A-Z][A-Z0-9](_[A-Z0-9]+)[.]md$) and comprehensive shell quoting for command generation.
Audit Metadata