claude-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes current conversation data to generate a summary that seeds the prompt for a new background agent. This creates a surface where malicious instructions from the conversation could be passed to the next agent.
- Ingestion points: Current conversation history and user-supplied arguments (SKILL.md).
- Boundary markers: None specified for the summary content.
- Capability inventory: Spawns new background processes using the
claudecommand (SKILL.md). - Sanitization: Instructions are provided to redact sensitive information such as API keys and passwords (SKILL.md).
- [COMMAND_EXECUTION]: The skill constructs and executes a shell command (
claude --bg) using parameters derived from conversation data. If the conversation summary is not properly escaped when the agent generates the command, it could lead to command injection.
Audit Metadata