handoff
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it summarizes conversation history and user input to influence the behavior of future agent sessions through a "suggested skills" section.
- Ingestion points: Processes the entire conversation history and user-provided arguments within SKILL.md.
- Capability inventory: Generates a document containing instructions and skill suggestions that a subsequent agent will treat as authoritative context.
- Boundary markers: There are no specific delimiters or warnings defined to prevent the next agent from following malicious instructions embedded in the summarized history.
- Sanitization: While the skill correctly instructs the agent to redact credentials (API keys, passwords) and PII, it does not include measures to sanitize the logic or instructions carried over from the history.
- [COMMAND_EXECUTION]: The skill instructs the agent to interact with the host file system by saving a document to the operating system's temporary directory, which is outside the current project workspace.
Audit Metadata