handoff
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted conversation history to generate a handoff document for future agents. This creates a pathway for malicious instructions embedded in the conversation to be summarized and later executed by a fresh agent reading the document.
- Ingestion points: Processes all content from the current conversation history (SKILL.md).
- Boundary markers: The instructions do not specify using delimiters or specific 'ignore' instructions for the generated output document.
- Capability inventory: The skill writes to the system temporary directory and influences which skills the next agent should invoke (SKILL.md).
- Sanitization: The skill provides a specific instruction to redact sensitive information like API keys, passwords, and PII.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill is instructed to save the handoff document specifically to the OS temporary directory rather than the local workspace. This behavior moves conversation data to a shared system location that may have broader access permissions than the project directory.
Audit Metadata