handoff
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and summarizes the current conversation history, which is a surface for indirect prompt injection if the conversation contains attacker-controlled inputs.
- Ingestion points: The entire conversation history is consumed as the primary source for the handoff document (SKILL.md).
- Boundary markers: The skill lacks programmatic boundary markers but includes a natural language instruction to "Redact any sensitive information" and "not duplicate content already captured in other artifacts."
- Capability inventory: The skill utilizes the agent's ability to write files to the user's OS temporary directory (SKILL.md).
- Sanitization: The skill relies on natural language instructions to redact API keys, passwords, or PII during the generation process.
Audit Metadata