claude-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes conversation history and user-provided arguments to generate a prompt for a background agent. 1. Ingestion points: Conversation history and user-supplied arguments are used to construct the handoff summary. 2. Boundary markers: Absent; no specific delimiters are instructed to separate the summary from instructions in the new session. 3. Capability inventory: Executes a shell command (claude --bg) to launch a new agent. 4. Sanitization: Absent; while it suggests redacting sensitive info, it does not mandate escaping or validation of the summary content.
- [COMMAND_EXECUTION]: The skill instructs the agent to run the
claudeCLI tool using a command string that interpolates the conversation summary. This creates a surface for command injection if the summary contains unescaped shell metacharacters such as backticks or dollar signs.
Audit Metadata