handoff
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill instructs the agent to save conversation summaries to shared system temporary directories (
/tmp,$TMPDIR, or%TEMP%) rather than the local project workspace. While intended for session persistence, this places potentially sensitive information in a location accessible by other local users. The risk is mitigated by explicit instructions to redact API keys, passwords, and PII before saving. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted conversation history to produce a document that influences the behavior of subsequent agent sessions, which is a surface for indirect prompt injection.
- Ingestion points: The entire conversation history is summarized into a new document (
SKILL.md). - Boundary markers: The skill lacks requirements for delimiters or "ignore embedded instructions" warnings in the generated output.
- Capability inventory: The agent performs file system writes to OS temporary directories (
SKILL.md). - Sanitization: No technical sanitization or escaping is performed on the summarized content beyond the instruction to redact secrets.
Audit Metadata