pact-handoff-harvest
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute Python code via the command line (
python3 -c) to process session journals and perform file management tasks. This practice of runtime script generation and execution increases the risk of command injection if parameters are influenced by untrusted data.\n- [COMMAND_EXECUTION]: The 'Orphaned Handoff Recovery' protocol directs the agent to perform destructive file system operations usingPath.unlink. While intended for cleanup, automating file deletion across directories (~/.claude/pact-sessions/*/*/) poses a risk of accidental data loss or unauthorized file removal.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests 'HANDOFF' content—untrusted text generated by other agents—and incorporates it into the 'pact-memory' and decision-making logic without sanitization or boundary markers.\n - Ingestion points: Session journals, task metadata, and handoff summaries (SKILL.md, Steps 1, 3, and 5).\n
- Boundary markers: Absent. The skill lacks instructions to treat ingested content as data rather than instructions.\n
- Capability inventory: Command execution (
python3 -c), file deletion (Path.unlink), memory modification (save,update), and cross-agent communication (SendMessage).\n - Sanitization: Absent. Content is extracted and saved directly to the project's permanent knowledge base.
Audit Metadata