claude-handoff
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
claudeCLI command to start background agents (claude --bg). This involves using shell command substitution ($(cat ...)) to read a temporary file containing the handoff summary. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to generate a summary of the current session to serve as the starting prompt for a new background agent, creating an injection surface.
- Ingestion points: User-supplied arguments and the entirety of the current conversation history (SKILL.md).
- Boundary markers: The skill uses the shell
--marker to separate arguments from content, but provides no delimiters or instructions to the second agent to ignore instructions embedded within the summary. - Capability inventory: The skill facilitates shell command execution via the
claudeCLI tool. - Sanitization: The instructions explicitly tell the agent to 'erase any sensitive information' like API keys or passwords, which is a positive security practice, but it does not address the risk of malicious instructions being carried over from a compromised conversation.
Audit Metadata