claude-code-handoff
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The skill script
scripts/claude_handoff_parser.pyexplicitly searches and reads files from sensitive local directories:~/.claude/projects/and~/.codefuse/engine/cc/projects/. These directories store the user's interaction history, code snippets, and environment metadata from Claude Code sessions. While the access is necessary for the skill's stated purpose, it exposes potentially sensitive developer data to the AI agent's context. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from
.jsonlsession files and incorporates it into aHANDOFF.mdfile and resumption instructions for the agent. This creates a surface where malicious instructions embedded in past conversations could influence the agent's future behavior. - Ingestion points: The
parse_session_filefunction inscripts/claude_handoff_parser.pyreads local.jsonlfiles provided via the-fargument or found in standard directories. - Boundary markers: The generated output uses standard Markdown headers but does not include specific delimiters or instructions to prevent the agent from obeying commands found within the parsed content.
- Capability inventory: The skill has the ability to write files (
HANDOFF.md) to the project workspace and provides command snippets for the agent to execute. - Sanitization: The script performs basic text trimming but does not sanitize the input for hidden instructions or prompt injection patterns.
Audit Metadata