openclaw-handoff
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository documentation, issue trackers, and PRs to generate prompts for other agents.
- Ingestion points: Workflow steps 1 and 2 in SKILL.md describe gathering context from user text, repository identity, issues, PRs, and branch names.
- Boundary markers: The prompt template in SKILL.md uses distinct headers (Context, Task, Validation, Output) and specific instructions for the receiving agent to review content before action.
- Capability inventory: The skill utilizes shell commands to access the system clipboard and interacts with the filesystem via temporary files.
- Sanitization: SKILL.md advises using temporary files or pipes instead of inline shell quoting to avoid injection of user-controlled text into shell commands.
- [COMMAND_EXECUTION]: The skill instructs the agent to use platform-specific clipboard utilities through shell execution. Evidence includes the use of pbcopy, wl-copy, xclip, and clip.exe in the Clipboard section of SKILL.md.
- [EXTERNAL_DOWNLOADS]: The MIRROR.md file identifies the skill as a vendored version of a repository hosted on GitHub (github.com/openclaw/agent-skills.git).
Audit Metadata