claude-handoff
Warn
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command
claude --bg --name "<name>" "<summary>". Both the name and the summary are dynamically generated from the current conversation context and user-provided arguments. This pattern presents a command injection risk if the agent does not properly escape characters like backticks, semicolons, or quotes when constructing the shell command. - [INDIRECT_PROMPT_INJECTION]: The skill creates a handoff chain where the output of the current session (the summary) becomes the input/instruction set for a new background agent process. An attacker could provide input in the current session designed to subvert the behavior of the subsequent agent.
- Ingestion points: User-provided arguments and conversation history are used to generate the handoff summary (SKILL.md).
- Boundary markers: None are specified to delimit the generated summary or protect the new agent from instructions embedded in the previous conversation history.
- Capability inventory: The skill has the capability to spawn new background agents with specific names and instructions using the
claudeCLI. - Sanitization: While the skill instructs the agent to manually "erase sensitive info" like API keys, there is no technical validation or sanitization to prevent the interpolation of malicious shell characters or prompt-altering instructions into the handoff payload.
Audit Metadata