handoff
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize the entire conversation history, which serves as a significant attack surface for indirect prompt injection.
- Ingestion points: Reads the current conversation context, decisions, and evidence from the agent's memory (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or instructions to prevent the agent from obeying malicious commands embedded within the chat history being summarized.
- Capability inventory: The skill has the capability to write files to the operating system's temporary directory.
- Sanitization: The skill explicitly includes a safety directive to mask sensitive information (API keys, passwords, PII) by replacing them with a redacted placeholder, which mitigates direct credential exposure during the handoff process.
- [DATA_EXPOSURE]: The skill directs the agent to write a document containing conversation summaries to a location outside the project workspace (the OS temporary directory). While intended for transient handoffs, this involves writing data to system paths that may be accessible by other local processes.
Audit Metadata