agent-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill generates a 'Start Prompt' and handoff documentation by interpolating user-provided task descriptions, workspace paths, and branch names. This surface allows malicious instructions in the task metadata to influence the behavior of the next agent thread. \n
- Ingestion points: CLI arguments passed to
scripts/create_handoff.pyand goal definitions inSKILL.md. \n - Boundary markers: The generated output uses markdown headers and code blocks, but does not include explicit delimiters or instructions to ignore embedded commands. \n
- Capability inventory: The skill writes to the local file system via the generator script and provides executable prompts to the agent context. \n
- Sanitization: None; input values are directly placed into the markdown template. \n- [CREDENTIALS_UNSAFE]: The instructions in
SKILL.mdunder the 'Hard-won Context' section advise the agent to include sensitive data, such as '.env file contents' and 'seeded credentials/cookies', directly in the markdown handoff file. This practice risks exposing secrets in plain text within documentation that may be version-controlled or shared.
Audit Metadata