The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (claude --bg --name "<name>" "<summary>") that incorporates user-provided content through string interpolation.
Evidence: SKILL.md contains instructions to launch a background agent using a shell command: claude --bg --name "<descriptive name>" "<handoff summary>".
Risk: If the generated summary or name contains shell metacharacters (such as backticks, semicolons, or command substitutions), it may lead to command injection, allowing arbitrary code execution on the host machine.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted conversation history and user arguments to generate a prompt for a successor agent session.
Ingestion points: SKILL.md uses the current conversation context and user-supplied arguments to build the summary.
Boundary markers: The skill lacks explicit boundary markers or instructions to the successor agent to ignore embedded commands within the summary.
Capability inventory: The skill possesses the ability to execute shell commands via the claude CLI tool.
Sanitization: While the instructions suggest redacting sensitive information, there is no technical validation to prevent malicious instructions from being passed through the summary to influence the behavior of the next agent.
[DATA_EXFILTRATION]: Conversation content is passed as plain-text arguments to a shell command.
Evidence: The instruction in SKILL.md passes the entire conversation summary as a command-line argument to claude --bg.
Risk: Command-line arguments are generally visible to other users and processes on the same system (e.g., via process listing tools like ps), which can lead to the exposure of sensitive conversation data despite the instruction to redact information.

claude-handoff