session-handoff
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to programmatically launch a successor session using the harness's command-line interface. This involves dynamic assembly of shell commands (e.g., the harness launch line) within a new terminal, which is a powerful capability that automates process spawning.
- [INDIRECT_PROMPT_INJECTION]: The primary function of the skill is to transplant the current session's context—including decisions, pending work, and 'identity/authority' claims—into a file for a future session to read. This creates a persistence vector where any prompt injection that successfully compromised the current session can be carried over to the next, circumventing the protection normally provided by a context reset.
- [DATA_EXFILTRATION]: The 'capture contract' (§7) mandates the collection of sensitive session identifiers, including task IDs, run IDs, dispatch IDs, terminal handles, and PR numbers, into a single markdown file located at
<<PRIMARY_ROOT>>/.session/handoffs/. While these files are intended to be local and gitignored, the aggregation of project metadata and absolute file paths in a single location increases the potential impact if the local file system is compromised.
Audit Metadata