handoff-torch
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary function is to generate markdown documentation within the local
docs/handoff/directory. It does not perform network operations or exfiltrate data to external servers. - [COMMAND_EXECUTION]: Uses benign, read-only shell commands (
date,git rev-parse,git log,git status) to collect context for the handoff document. These commands are restricted to gathering local environment metadata (timestamp, branch name, and commit history). - [DATA_EXFILTRATION]: Includes explicit safety instructions for the AI agent to avoid including sensitive data: "Keep secrets out. Test-mode IDs and public config are fine; real API keys, tokens, and passwords never go in a committed doc."
- [PROMPT_INJECTION]: Instructions focus on task summarization and context preservation. No attempts to override safety filters or hijack agent behavior were found.
Audit Metadata