claude-handoff
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a system command (
claude --bg) to start a background process. This is the intended primary function of the skill. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8). It ingests untrusted data from the current conversation history and user-supplied arguments to create a summary. This summary is then used as the initialization prompt for a new background agent. There is a risk that malicious instructions present in the conversation could be included in the summary, influencing the behavior of the next agent instance.
- Ingestion points: Conversation history and user-provided arguments in
SKILL.md. - Boundary markers: The summary is interpolated into a shell command, but there are no instructions to include markers that distinguish the summarized content from instructions for the next agent.
- Capability inventory: Execution of the
claudeCLI via shell commands (SKILL.md). - Sanitization: The skill explicitly instructs the agent to redact sensitive information like API keys and PII, which is a positive security measure, but it does not provide mechanisms to sanitize or ignore malicious instructions embedded in the summarized data.
Audit Metadata