handoff
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied conversation history to generate a handoff document and suggested skills for future sessions. This creates a surface where malicious input in the conversation could influence the agent's future instructions.
- Ingestion points: The entire current conversation history (SKILL.md).
- Boundary markers: None specified. The skill does not provide delimiters to isolate conversation data from the summary instructions.
- Capability inventory: The skill writes to the filesystem in the OS temporary directory (SKILL.md).
- Sanitization: Instructions include an explicit requirement to redact API keys, passwords, and personally identifiable information.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill saves its output to the operating system's temporary directory instead of the project workspace. While this is the intended functionality for session handoffs, it involves file system access outside the controlled workspace environment.
Audit Metadata