handoff
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted conversation history to generate handoff documents and skill recommendations for future agents, creating an attack surface for indirect prompt injection.\n
- Ingestion points: The current conversation history is ingested as the primary data source (SKILL.md).\n
- Boundary markers: No delimiters or boundary markers are used to separate conversation data from the summary template.\n
- Capability inventory: The skill has the capability to write the generated summaries to the operating system's temporary directory.\n
- Sanitization: While the skill explicitly instructs the agent to redact sensitive information like API keys and passwords, it does not include instructions to sanitize or ignore embedded commands within the conversation history.\n- [DATA_EXFILTRATION]: The skill reads from a project document located outside the skill's base directory (../../WORK-ROUTING.md) and writes the resulting summary to the user's OS temporary directory rather than the current workspace.
Audit Metadata