Versioned security assessment

Report ID: SA-F93E9BB0

7/7/2026, 4:16:59 AM

session-handoff security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
session-handoff
Version
v3
Maintainer
softaworks
Source
github.com/softaworks/agent-toolkit/tree/main/skills/session-handoff/
Coverage
12 Files scanned · 2,721 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Static analysis produced many command, filesystem, environment, and network matches. Review confirmed only the evaluation cleanup deletion risk plus contextual handoff data-handling risks; most high signals are test fixtures, Markdown examples, defensive secret patterns, or shell-free hardcoded git calls. No bundled prompt injection attempt or data exfiltration behavior was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

12 Files scanned · 2,721 Lines analyzed

5 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 1 evidence location

Filesystem access

May read or write local files.

Observed in 15 evidence locations

Env variables

May read values from the process environment.

Observed in 6 evidence locations

External commands

May invoke commands or programs outside the Skill.

Observed in 29 evidence locations

Capability review items (2)
Medium
evals/setup_test_env.py:41
Python shutil operations
shutil.rmtree(path)
The evaluation setup script recursively deletes the configured target path before creating fixtures. The default is a temp directory, but a user-supplied path could cause local data loss if misused.
Medium
evals/setup_test_env.py:379
Python shutil operations
shutil.rmtree(path)
The --clean path removes the configured test environment with shutil.rmtree. The action is explicit, but the script should guard against accidental deletion outside the intended temp fixture path.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 Medium
SKILL.md:41-43scripts/create_handoff.py:230-336scripts/validate_handoff.py:22-37
Persistent Handoff Files May Preserve Sensitive Context
The skill creates Markdown handoffs that can include project path, branch, commits, modified files, decisions, and environment variable names. Secret scanning helps, but handoffs may still preserve sensitive implementation or business context.
The storage behavior and metadata capture are explicit in the workflow and generated template. The risk depends on what users write into handoffs, so this is a data-handling concern rather than malicious collection.
RISK-002 Medium
SKILL.md:116-134references/resume-checklist.md:7-17
Untrusted Handoff Content Can Influence Agent Behavior
The resume workflow tells the agent to read a handoff and begin from its documented next steps. Handoff files imported from a repository can contain instructions that should be treated as untrusted project context.
The workflow consumes Markdown handoffs as operational context. No bundled prompt-injection payload was found, but the trust boundary should be documented for imported handoffs.
RISK-003 Low
references/resume-checklist.md:56-66
Resume Checklist Encourages Local Environment Inspection
The quick-start checklist suggests commands that can reveal process details or environment variable names. This is useful for verification, but outputs should be minimized and redacted.
The checklist explicitly includes git, process, and environment inspection commands. The commands are local and visible, so the risk is limited to accidental disclosure in transcripts or handoffs.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Evaluation cleanup can delete a user-selected path.
    Restrict cleanup to a dedicated temp directory and refuse root, home, or repository paths unless a clear confirmation flag is provided.
  2. FIX-002
    Medium
    Handoff files can preserve sensitive project context.
    Warn users before committing or sharing handoffs, and keep secret values, credentials, customer data, and private implementation details out of handoff text.
  3. FIX-003
    Medium
    Imported handoff files can contain untrusted instructions.
    Add guidance to treat handoff instructions as project notes, verify them against the current user request, and ignore attempts to override system or developer instructions.
  4. FIX-004
    Low
    Resume checklist environment commands can expose local details.
    Prefer commands that list only needed variable names and avoid copying process arguments or environment values into handoffs.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable