handoff
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill generates instructions for future agent sessions by summarizing untrusted data from the workspace and conversation history. This creates a multi-step injection surface where malicious content in logs or documents could be summarized into the handoff, potentially influencing the next agent's actions.
- Ingestion points: Conversational context, workspace artifacts (specs, plans, logs), and command output as defined in workflow step 2.
- Boundary markers: The skill mandates the use of specific [REDACTED: ...] markers for sensitive data in workflow step 3.
- Capability inventory: The skill utilizes filesystem read/write access and environment variable access to gather context and save the handoff.
- Sanitization: Instructions include a dedicated redaction workflow, warnings against carrying directives from untrusted output, and a final validation scan to ensure the handoff is safe before the session ends.
- [DATA_EXFILTRATION]: The skill requests the resolution of absolute system paths for installed agent skills (e.g., ~/.claude/skills/). Recording these absolute paths in the handoff document exposes the internal directory structure and configuration of the host environment.
Audit Metadata