small-model-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process task specifications from external plan documents, which could lead to malicious instruction injection if the plan files are compromised.
- Ingestion points: The 'Handoff Gate' in
SKILL.mdallows core execution fields such as 'Outcome', 'Procedure', and 'Scope' to be populated by referencing external plan files and task IDs. - Boundary markers: While the skill utilizes a structured Markdown template (
assets/execution-prompt.template.md) to organize instructions, the downstream model is directed to interpret the full content of the referenced plan files. - Capability inventory: The resulting handoff prompts authorize the downstream executor to perform sensitive operations including file modifications (
changemode), shell command execution (runmode), and targeted data access (inspectmode). - Sanitization: The skill explicitly instructs the agent to 'Never paraphrase content that lives in the plan file,' ensuring the downstream executor directly consumes the original content of the external file without sanitization or filtering.
Audit Metadata