pickup
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill demonstrates a surface for indirect prompt injection by processing external data as instructions.
- Ingestion points: The skill reads the full content of Markdown files located in
.claude/handoffs/into the active session context. - Boundary markers: None are specified; the agent is instructed to read the "full text" including context and completion definitions without delimiters to isolate untrusted content.
- Capability inventory: The skill uses shell commands (
grep) and file editing tools to manage the handoff lifecycle. - Sanitization: No validation or sanitization is performed on the content of the handoff files before they are interpreted as working instructions.
- [COMMAND_EXECUTION]: The skill executes a local shell command (
grep -l "^status: pending" .claude/handoffs/*.md) to identify tasks. This is restricted to a specific local directory and uses a static pattern, which is considered a standard operational practice for this use case.
Audit Metadata