handoff
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes the current conversation history, which serves as an ingestion point for untrusted data. A malicious user could embed instructions within the conversation that the agent might inadvertently follow during the summarization process. Ingestion points: Current conversation history (referenced in SKILL.md). Boundary markers: The instructions lack explicit delimiters or warnings to treat conversation content strictly as data. Capability inventory: The agent is instructed to perform file-write operations to the system's temporary directory. Sanitization: Although the skill directs the agent to redact secrets, it does not provide mechanisms for sanitizing or escaping instructions within the content.
- [COMMAND_EXECUTION]: The skill instructs the agent to write files to the operating system's temporary directory ($TMPDIR, /tmp, or %TEMP%). While intended for handoff persistence, writing files outside the immediate project workspace can expose conversation summaries to other users or processes on the same system.
Audit Metadata