Model Handoff

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:45 AM UTC
• Version: 1.0.0

Overview

The skill helps with model handoffs, but it can persist sensitive context and alter future agent startup behavior without clear user approval.

Install only if you are comfortable with a skill that creates persistent handoff files and may modify AGENTS.md. Review HANDOFF.md before sharing it, remove credential-file paths and private profile or memory references, and require explicit approval before any AGENTS.md change or proactive update.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:16

Finding

Persistent Instruction Propagation Through HANDOFF.md

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-43, SKILL.md:46-68, and references/template.md:8-15,42-46
Vulnerability Type: Persistent agent-state poisoning
Risk Level: Medium

Evidence

SKILL.md:16-43 defines a persistent handoff file containing identity and behavioral instructions:

markdown

Write `HANDOFF.md` to the workspace root with these sections:

```markdown
# HANDOFF.md — Model Switch Context

## Who you are
[Agent name, persona, tone, key behavioral rules. Reference SOUL.md if present.]

## Who you're helping
[User name, role, location, preferences. Reference USER.md and MEMORY.md if present.]

## Active projects
[For each project: name, status, key files, next steps. Be specific — include file paths.]

## Agent roster
[If multi-agent: list agent IDs, models, roles.]

## Key credentials & tools
[Point to credential files — never inline secrets. e.g. "Azure SP creds: azure-config.json"]

## Behavioral rules
[Critical rules a new model must follow. Keep to essentials only.]

## How to keep this file current
[Brief note on when to update.]

## Last updated
[Timestamp + 1-line session summary]

text

`SKILL.md:46-68` directs the agent to update this state proactively and make future models load it:

```markdown
## When to Create/Update

**Create** `HANDOFF.md` when:
- User asks about switching models
- User asks how to preserve context
- `HANDOFF.md` does not yet exist

**Update** `HANDOFF.md` when:
- User says "switching to [model]" — update immediately before they go
- User says "update HANDOFF" or "log everything"
- A significant project milestone is reached (new project started, major decision made, new agent added)
- The session has been running for several hours with significant new context

**Keep current proactively** — do not wait to be asked. Update during long sessions when meaningful things happen.

## Wiring HANDOFF.md into
...[truncated 3140 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before creating or updating HANDOFF.md, especially before persisting persona or behavioral directives.
2. Do not modify AGENTS.md automatically. Present the proposed change and require approval.
3. Treat all handoff content as untrusted informational context rather than authoritative instructions.
4. Add an explicit rule prohibiting persistence of instructions that alter safety constraints, permissions, tool policies, system roles, or instruction precedence.
5. Persist factual task state separately from behavioral preferences; omit the Behavioral rules section unless the user explicitly supplies and approves its contents.
6. Record provenance for every persisted directive, including its source and approval status.
7. Display a complete diff before writing either HANDOFF.md or AGENTS.md.
8. Instruct receiving models to validate handoff content against current system, developer, and user instructions before acting on it.
9. Use a strict schema with an allowlist of safe fields rather than copying free-form session text.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:21

Finding

Disclosure of Sensitive Memory and Credential-File Locations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-34 and references/template.md:13-19,37-40
Vulnerability Type: Sensitive-resource metadata exposure
Risk Level: Low

Evidence

SKILL.md:21-34 directs the handoff document to reference private context and credential files:

markdown

## Who you are
[Agent name, persona, tone, key behavioral rules. Reference SOUL.md if present.]

## Who you're helping
[User name, role, location, preferences. Reference USER.md and MEMORY.md if present.]

## Active projects
[For each project: name, status, key files, next steps. Be specific — include file paths.]

## Agent roster
[If multi-agent: list agent IDs, models, roles.]

## Key credentials & tools
[Point to credential files — never inline secrets. e.g. "Azure SP creds: azure-config.json"]

references/template.md:13-19,37-40 reinforces these references:

markdown

## Who you are
- You are **[Agent Name]** — [one-line persona description]
- [Tone/style notes. e.g. "Formal, call user Sir."]
- Full persona: read `SOUL.md`

## Who you're helping
- **[User Name]** — [role, location]
- [Any key personal context worth noting]
- Full context: read `USER.md` and `MEMORY.md`

markdown

## Key credentials & tools
- **[Service]:** credentials in `[filename]`
- **[Service]:** API key in `[filename]`
(Never inline secrets here — point to files only)

Technical Analysis

The Skill correctly prohibits placing secret values directly into HANDOFF.md, but it still encourages recording the exact locations of credential files and directing future models toward files likely to contain private profile or memory data.

File paths and resource names are sensitive metadata. They identify where valuable data is stored, reduce discovery effort, and encourage future agents to access information that may not be necessary for the current task. Because HANDOFF.md is explicitly ...[truncated 1442 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove credential-file locations from HANDOFF.md by default.
2. Refer to capabilities generically, such as “cloud deployment access is configured,” rather than naming secret-bearing files.
3. Require explicit user consent and a demonstrated task need before referencing USER.md, MEMORY.md, SOUL.md, or credential stores.
4. Apply data minimization: include only information required for the next model to continue the active task.
5. Separate private context from the shareable handoff document and use access-controlled storage for sensitive metadata.
6. Add warnings that receiving models must not open referenced private or credential files unless the current task requires it and authorization has been confirmed.
7. Scan proposed handoff content for filenames, paths, personal information, tokens, keys, and other sensitive metadata before writing it.
8. Provide a user-visible preview and redaction step before the handoff file is saved or shared.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says to use the skill not only when asked about model switching but also 'proactively during long sessions.' That broad activation guidance can cause the agent to invoke the skill and write state to disk without a clear, contemporaneous user request, increasing the chance of unnecessary persistence of context or sensitive project details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill directs the agent to write HANDOFF.md to the workspace root as a normal operating step, but it does not require a clear warning or consent flow for persistent file creation/modification. In a context-handoff skill, silent writes are especially risky because the file may accumulate user, project, and behavioral data that persists beyond the current session.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly tells the agent to include a 'Key credentials & tools' section in HANDOFF.md and to point to credential files. Even without inlining secrets, aggregating credential locations in a portable handoff file increases discoverability of sensitive assets and exceeds the minimum context needed for model handoff, making later misuse easier if the file is read by the wrong model, user, or shared externally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The create/update triggers include vague conditions like 'significant project milestone' and sessions running 'for several hours with significant new context.' Ambiguous triggers give the agent broad discretion to persist conversation state, which can lead to over-collection, surprise file writes, and inclusion of information beyond what the user intended to save.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill's declared purpose is maintaining HANDOFF.md, but it also instructs the agent to modify AGENTS.md so future models auto-read the handoff. This is a scope expansion into persistent workspace policy modification, which can silently alter agent behavior across sessions without clear user authorization and creates a stronger persistence mechanism than the user requested.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction to update the file when the user says 'switching to [model]' uses a broad conversational trigger that could be activated during ordinary discussion rather than a deliberate workflow command. In an auto-invoked skill context, that ambiguity can cause unintended updates to persistent context files, potentially recording or propagating stale, irrelevant, or sensitive information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes this skill as maintaining a HANDOFF.md file so context survives model switches. This template goes further by instructing the next model to read SOUL.md, USER.md, and MEMORY.md, extending the skill's effective capability into orchestrating broader workspace context access that is not stated in the manifest.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Including a 'Key credentials & tools' section normalizes documenting where credentials or API keys are stored, which can help a successor model discover and use sensitive material beyond the narrow handoff purpose. In a model-switching skill, that increases the chance that future models are guided toward secret-bearing files, expanding exposure and enabling unintended secret access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.