session-handoff
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection (Category 8). It ingests untrusted data from the conversation history and environment variables (
CLAUDE_CODE_SESSION_ID) and interpolates them into file writes (docs/handoffs/) and tool calls (mem_save,mem_session_summary). - Ingestion points: Reads
CLAUDE_CODE_SESSION_IDand the entire conversation history (SKILL.md Step 1, Step 3). - Boundary markers: None. The skill does not use delimiters or instructions to the agent to ignore embedded instructions within the conversation history when drafting the summary.
- Capability inventory: The skill has write access to the filesystem (
docs/handoffs/) and external memory tools (mem_save,mem_session_summary). - Sanitization: No evidence of escaping or filtering content extracted from the conversation history before it is written to disk or saved to the memory tool.
Audit Metadata