session-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Python scripts including
create_handoff.py,check_staleness.py, andsetup_test_env.pyutilize thesubprocessmodule to executegitcommands. These calls gather project history, branch details, and file status to populate handoff documents. The implementation uses argument lists rather than shell strings. - [INDIRECT_PROMPT_INJECTION]: The skill reads handoff documents that contain externally-sourced data from the project's Git history and file structure.
- Ingestion points: The
RESUME WorkflowinSKILL.mddirects the agent to read handoff files from the.claude/handoffs/folder. - Boundary markers: Metadata is inserted into the handoff template without explicit markers to distinguish between data and instructions.
- Capability inventory: The skill provides functionality for file system access and Git command execution via subprocess.
- Sanitization: The
validate_handoff.pyscript performs scans for secrets and TODO placeholders but does not filter natural language content for potential injection attacks.
Audit Metadata