handoff
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill summarizes the current conversation, which can include untrusted data from previous messages or tool outputs.
- Ingestion points: The skill processes the entire "current conversation" (defined in
SKILL.md). - Boundary markers: There are no explicit boundary markers or delimiters defined to isolate untrusted conversation content from the agent's instructions.
- Capability inventory: The skill possesses the capability to write files to the operating system's temporary directory.
- Sanitization: The instructions explicitly direct the agent to "Redact any sensitive information, such as API keys, passwords, or personally identifiable information."
- [DATA_EXPOSURE]: The skill instructs the agent to write conversation summaries to the operating system's temporary directory, which is outside the controlled project workspace and may be accessible to other users or processes on the same system.
- Evidence: The instruction "Save to the temporary directory of the user's OS
- not the current workspace" in
SKILL.mddirects data placement outside the restricted environment.
Audit Metadata