handoff
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by ingesting and acting upon session state data from external JSON files.
- Ingestion points: The skill reads state information from JSON files (typically stored in .claude/handoffs/ or user-defined paths), including pending_steps, constraints, and decisions.
- Boundary markers: The instructions do not define delimiters or provide warnings to the agent to ignore potentially malicious instructions embedded in the loaded state files.
- Capability inventory: The skill uses the Read and Write tools to interact with the project filesystem, providing a mechanism for actions directed by the loaded state.
- Sanitization: No validation or sanitization is performed on the JSON content before the agent adopts the tasks and constraints defined within it.
Audit Metadata