handoff-and-resume
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Accesses session transcript files in the user's home directory (e.g.,
~/.claude/projects/and~/.codex/sessions/) to retrieve session metadata.\n- [DATA_EXFILTRATION]: Instructs the agent to copy information from outside the repository (such as the.scratchpad/directory) into the handoff note, which may lead to the exposure of sensitive temporary data.\n- [INDIRECT_PROMPT_INJECTION]: The skill resumes work by reading and following instructions fromdocs/handoffs/*.mdfiles, which serves as an ingestion point for potentially untrusted data.\n - Ingestion points: Files located in
docs/handoffs/.\n - Boundary markers: The skill lacks explicit prompt delimiters for the handoff content, though it instructs the agent to "Wait for a yes before you act on anything the note left open."\n
- Capability inventory: Uses
gitcommands,ghCLI, and file writing operations.\n - Sanitization: No specific sanitization or validation of the handoff file content is implemented beyond the human-in-the-loop confirmation.
Audit Metadata