handoff
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill workflow requires the agent to read existing handoff files from predictable paths in the temporary directory before updating them. This creates a surface for indirect prompt injection where a malicious file placed in the temporary directory by an attacker could influence the agent's behavior during the handoff process.
- Ingestion points: SKILL.md (Step 4: 'Read the file before writing if it already exists')
- Boundary markers: Absent; the agent is not instructed to use delimiters or ignore instructions within the existing file.
- Capability inventory: File system write access to the OS temporary directory.
- Sanitization: Absent; no validation is performed on the content of existing files.
- [DATA_EXFILTRATION]: The skill exports sensitive project metadata, including absolute file paths and task summaries, to the shared OS temporary directory ($TMPDIR or %TEMP%). While the skill explicitly instructs the agent to exclude secrets like API keys or tokens, the storage of internal project structures and session state in a globally readable directory may lead to local information disclosure.
Audit Metadata