handoff
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a composition guide at 'https://raw.githubusercontent.com/csark0812/toolbox/main/references/v2/process-skill-composition.md'. This is a documentation resource hosted in the author's own repository.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves gathering state and decisions from the current conversation (untrusted data) to transfer to a new agent session. This creates an attack surface where malicious instructions in the chat history could be included in the handoff, potentially compromising the subsequent session.
- Ingestion points: The skill gathers bullets from the conversation thread (SKILL.md).
- Boundary markers: The output templates in 'references/output.md' use headers and fenced blocks but lack explicit instructions for the receiving agent to disregard embedded natural language commands within the handoff data.
- Capability inventory: The skill is capable of writing files to the workspace path '_agent/handoffs/' and interacting with chat APIs like Codex to create threads.
- Sanitization: The skill mandates the redaction of secrets, tokens, and PII, although it does not provide mechanisms to sanitize or filter potential prompt injection instructions from the gathered text.
Audit Metadata