handoff
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process the current conversation and working state to generate a summary, which represents an ingestion surface for potentially untrusted data.
- Ingestion points: The agent's current conversation history and working state are processed to create the handoff document.
- Boundary markers: No specific boundary delimiters are defined for the input data processing.
- Capability inventory: The skill utilizes file writing capabilities to save markdown documents to the local filesystem (
~/.codex/artifacts/handoffs/). - Sanitization: The skill contains explicit instructions to the agent to redact secrets, tokens, and personal data using a
<REDACTED>placeholder convention, which serves as a mitigation for data exposure risks. - [SAFE]: The skill does not perform any network operations, remote code execution, or privilege escalation. It explicitly disables model invocation (
disable-model-invocation: true) to restrict the agent's actions during the handoff process. The local file writing is restricted to a specific artifact directory.
Audit Metadata