handover
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest the entire conversation history, which is untrusted data, and output a summary using the
Writetool. This creates a surface for indirect prompt injection where malicious instructions embedded in the conversation could be persisted into the handoff file and subsequently influence other agents or processes reading that file.\n - Ingestion points: Current conversation history (SKILL.md).\n
- Boundary markers: Absent.\n
- Capability inventory: File creation and writing via the 'Write' tool (SKILL.md).\n
- Sanitization: Absent; the skill relies on natural language instructions for accuracy and verification rather than technical sanitization or escaping of the summarized content.
Audit Metadata