claude-handoff
Warn
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a shell command (
claude --bg --name "<descriptive name>" "<handoff summary>") using strings derived from the current conversation. The lack of instructions for shell-safe escaping or sanitization of these variables creates a risk of command injection if the user provides content containing shell metacharacters like backticks or subshells. - [INDIRECT_PROMPT_INJECTION]: The handoff summary, which includes untrusted data from the conversation history, is used as the initial prompt for a new background agent session. This allows malicious instructions in the current context to persist and influence the behavior of the next agent.
- Ingestion points: Conversation history and user-supplied arguments in SKILL.md.
- Boundary markers: Absent; the summary is directly seeded as the next agent's prompt without delimiters.
- Capability inventory: Shell command execution (
claude --bg). - Sanitization: Instructions for redacting PII and credentials are included, but do not address potential prompt injection or shell character escaping.
- [DATA_EXFILTRATION]: While the skill advises redacting sensitive information, it relies on the agent's manual compliance. This creates a risk where API keys, passwords, or PII from the current session are inadvertently included in the summary passed to the background process.
Audit Metadata