handshake

• Outcome: Pass
• Latest audit: Sep 22, 2026 · 3:03 AM UTC
• Version: 0.1.0

Overview

This skill coherently saves and reloads branch-scoped local work-session notes, with no evidence of hidden exfiltration, destructive behavior, or privilege escalation.

Install this only if you want Codex session state saved locally by project and branch. Treat handshake files as editable notes, not trusted authority: review them when working on sensitive repositories, and be aware that closing a session replaces the previous branch handoff file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes shell/Python execution against the local environment but does not declare any explicit tool scope or allowed-tools boundary. That makes the skill under-specified from a security perspective and increases the chance an agent executes filesystem-affecting commands without clear least-privilege constraints or review expectations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Mode Resolution

Opening this skill without `close` means **open**. Run the open flow immediately; do not ask the user whether this is the start or end of a session.

Only use the close flow when the user explicitly includes `close`, or clearly asks to close, save, summarize, or end the session. This prevents a newly opened chat from overwriting the compact context it needs to load.

• Confidence: 86% confidence
• Finding: The skill directs the agent to decide the operating mode automatically and to run the open flow immediately without asking the user. Autonomous execution is risky here because it triggers environment inspection and file discovery behavior based solely on invocation syntax, reducing user awareness and consent around local state access.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

python3 <skill-dir>/scripts/session_handshake.py open --cwd <current-working-directory>
```

If a handshake is found, read it before doing project work. Read its sections in this order: **Macro Vision & Architectural Context**, **File Anchors**, **Relevant Skill Memory**, then **Next Actions**. Inspect the anchored files first and verify the saved state against the actual repository before making changes; do not scan broad directories unless the anchors are insufficient. Use a listed skill only when it applies to the next action; do not load every past skill merely because it was recorded. Give a compact continuation briefing: the goal, where work stopped, the macro context, what was verified, blockers, relevant skills, and the ordered next actions. Then continue directly with the first unresolved next action. Do not ask the user to confirm opening the session.

Pause only when the handshake records a blocker, an open question that materially affects the next action, or no remaining action. Say exactly what is needed in that case.

• Confidence: 90% confidence
• Finding: This instruction goes further by telling the agent to read stored handshake content, inspect anchored files, and continue directly with the first unresolved action without user confirmation. In context, that can cause unreviewed propagation of stale, poisoned, or attacker-edited local instructions into the current session, effectively treating persisted markdown as an implicit command source.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_git(cwd: Path, args: list[str]) -> str | None:
    try:
        result = subprocess.run(
            ["git", *args],
            cwd=str(cwd),
            check=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The close flow tells the agent to replace the existing branch handshake file, which is persisted session data, without any warning, backup, or confirmation step. This can silently destroy prior context, making recovery difficult and enabling accidental loss or tampering with session continuity data.

Static analysis

No suspicious patterns detected.