worker-handover
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION] (LOW): The skill utilizes the
Bashtool to perform repository management and testing tasks usinggit,pnpm, and theghCLI. These actions are consistent with the skill's stated purpose. - [PROMPT_INJECTION] (LOW): The skill is vulnerable to Indirect Prompt Injection (Category 8).
- Ingestion points: Handover data is retrieved from GitHub issue comments using the
gh apicommand inSKILL.md. - Boundary markers: The process relies on
<!-- HANDOVER:START -->and<!-- HANDOVER:END -->tags. These markers identify the data but do not prevent the inclusion of malicious instructions within the handover body. - Capability inventory: The agent possesses powerful tools, including arbitrary
Bashexecution and GitHub integration (mcp__github__*), which could be leveraged if the agent inadvertently follows instructions embedded in a comment. - Sanitization: There is no evidence of sanitization or validation of the fetched comment content, allowing external, potentially adversarial text to enter the agent's context.
Audit Metadata