pact-handoff-harvest

Warn

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute Python code via the command line (python3 -c) to process session journals and perform file management tasks. This practice of runtime script generation and execution increases the risk of command injection if parameters are influenced by untrusted data.\n- [COMMAND_EXECUTION]: The 'Orphaned Handoff Recovery' protocol directs the agent to perform destructive file system operations using Path.unlink. While intended for cleanup, automating file deletion across directories (~/.claude/pact-sessions/*/*/) poses a risk of accidental data loss or unauthorized file removal.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests 'HANDOFF' content—untrusted text generated by other agents—and incorporates it into the 'pact-memory' and decision-making logic without sanitization or boundary markers.\n
  • Ingestion points: Session journals, task metadata, and handoff summaries (SKILL.md, Steps 1, 3, and 5).\n
  • Boundary markers: Absent. The skill lacks instructions to treat ingested content as data rather than instructions.\n
  • Capability inventory: Command execution (python3 -c), file deletion (Path.unlink), memory modification (save, update), and cross-agent communication (SendMessage).\n
  • Sanitization: Absent. Content is extracted and saved directly to the project's permanent knowledge base.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 21, 2026, 09:28 PM
Security Audit — agent-trust-hub — pact-handoff-harvest