The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions direct the agent to launch a background process using the template claude --bg --name "<descriptive name>" "<handoff summary>". Because the <descriptive name> and <handoff summary> are derived from user arguments and conversation history, a malicious user could provide input containing shell metacharacters (such as backticks, semicolons, or command substitutions) to escape the quotes and execute arbitrary commands on the host system.
[DATA_EXFILTRATION]: The conversation summary, which may contain sensitive context, is passed directly as a command-line argument. On most operating systems, command-line arguments are visible to all users and processes via process monitoring tools (e.g., ps, top, or activity monitors). This creates a risk of sensitive data exposure to unauthorized local observers, even with the redaction instructions provided in the skill.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the way it handles untrusted data.
Ingestion points: The skill ingests the entire "current conversation" and user-provided arguments in SKILL.md to generate a new prompt.
Boundary markers: No delimiters or "ignore" instructions are used to separate the generated summary from the next agent's system instructions.
Capability inventory: The skill has the ability to trigger shell command execution via the claude CLI.
Sanitization: The skill includes a high-level instruction to "Redact any sensitive information," but lacks robust automated sanitization or escaping mechanisms to prevent malicious instructions within the conversation from influencing the background agent's behavior.

claude-handoff