openclaw-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill aggregates potentially untrusted data from the repository and user input to generate instructions for another AI agent.
- Ingestion points: User task descriptions, repository source code, linked issues, pull request content, and documentation strings are used to populate the handoff template.
- Boundary markers: The prompt template lacks specific delimiters (e.g., XML tags or unique markers) to isolate external context from the instructions, increasing the risk that the receiving agent follows instructions embedded in the data.
- Capability inventory: The skill writes to local temporary files and executes shell commands to interact with the system clipboard.
- Sanitization: No sanitization or escaping of the gathered repository data is performed before interpolation into the handoff prompt.
- [COMMAND_EXECUTION]: The skill uses system shell commands to perform clipboard operations.
- Evidence: Instructions include the use of
pbcopy,wl-copy,xclip, andclip.exeto process the handoff text. - [DATA_EXPOSURE]: The skill extracts information about the current project environment and exposes it via the system clipboard.
- Evidence: Gathering of product identity, branch names, issue URLs, and symbol names to create the standalone prompt.
Audit Metadata