handoff
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill summarizes untrusted data from the current conversation to create instructions and context for a subsequent agent session. This creates a surface where malicious instructions embedded in the conversation history could be summarized into the handoff document and influence the next agent's behavior.
- Ingestion points: The skill reads and processes the entirety of the "current conversation" as specified in SKILL.md.
- Boundary markers: The skill lacks explicit instructions to isolate or ignore embedded instructions within the conversation history.
- Capability inventory: The skill requires file-write capabilities to save the summary document to the user's OS temporary directory.
- Sanitization: While the skill instructs the agent to redact sensitive information (PII, API keys), it does not include measures to sanitize the content for prompt injection payloads.
- [COMMAND_EXECUTION]: The skill instructs the agent to perform file system operations outside the standard project workspace by saving the generated handoff document to the user's OS temporary directory (SKILL.md).
Audit Metadata