handoff
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill summarizes conversation history and user-provided arguments, which are untrusted data sources. It lacks explicit delimiters or instructions to ignore potentially malicious embedded commands.
- Ingestion Point: Current conversation history and user arguments.
- Boundary Markers: Absent.
- Capability Inventory: File system read (PRDs, plans, ADRs, etc.) and write operations via mktemp.
- Sanitization: No sanitization or validation of input content before writing to disk.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the mktemp shell utility to generate a file path. While this is a common utility for temporary file creation, it represents a direct command execution pattern.
- [DATA_EXFILTRATION]: Local Data Exposure. The summary document, which may contain sensitive project information, is saved to the /tmp directory. On multi-user systems, files in /tmp may be readable by other users, potentially exposing sensitive details from the conversation and project artifacts.
Audit Metadata