handoff
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to summarize untrusted conversation data and store it in a file (
handoff.md) specifically for consumption by a future agent. This establishes a clear multi-step chain vulnerability. - Ingestion points: The agent processes the entirety of the current conversation context (SKILL.md).
- Boundary markers: The skill uses a standard Markdown template for output but lacks explicit delimiters or instructions for the resuming agent to treat the content as untrusted.
- Capability inventory: The skill possesses the capability to write to the file system (SKILL.md).
- Sanitization: There are no instructions to sanitize, filter, or escape the content being summarized to prevent the inclusion of malicious instructions targeting the next agent.
- [PROMPT_INJECTION]: The skill explicitly instructs the agent to use a user-provided path for the output file without mandating validation or sanitization of that path. This could be exploited to perform path traversal or overwrite sensitive files.
- Evidence: "If the user specified a path in their prompt, use it." (SKILL.md).
Audit Metadata