handoff
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes handoff documents that contain natural language instructions, which can be used to influence the agent's behavior in subsequent sessions.\n
- Ingestion points: The
Consume WorkflowinSKILL.mddirects the agent to read and follow the 'Immediate Next Steps' from a handoff file.\n - Boundary markers: The skill recommends verifying the handoff against the live workspace state, but does not provide robust delimiters to prevent the agent from obeying adversarial instructions within the document.\n
- Capability inventory: The agent's ability to execute commands and modify files makes it susceptible to executing malicious steps listed in a compromised handoff file.\n
- Sanitization: No sanitization or filtering logic is applied to the handoff content before the agent adopts it as its new task list.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill is designed to collect and aggregate metadata about the current workspace environment.\n
- The
Produce WorkflowinSKILL.mdinstructs the agent to gather information on the current branch, dirty files, recent commits, and active processes.\n - Although the skill contains explicit instructions to never include secrets or passwords, the systematic collection of repository and environment metadata increases the surface area for information exposure.
Audit Metadata