handoff
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill compacts the current conversation into a handoff document meant to guide a fresh agent. Because the conversation history may contain untrusted user input, there is a risk that malicious instructions could be summarized and later executed or obeyed by the receiving agent.
- Ingestion points: The current conversation history is ingested as the primary source for the summary (referenced in SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or boundary markers to separate the agent's summary from potentially untrusted content within the summary.
- Capability inventory: The skill involves writing the output summary to the user's OS temporary directory and includes a section for 'suggested skills' that the next agent should invoke.
- Sanitization: The instructions explicitly require the redaction of sensitive information like API keys and passwords, but they do not provide specific guidance on sanitizing or escaping natural language instructions found within the conversation history.
Audit Metadata