The Agent Skills Directory

[COMMAND_EXECUTION]: The skill directs the agent to launch a background process using the command claude --bg --name "<name>" "<summary>". The <summary> is a string generated by the LLM based on conversation history and user input. Direct interpolation into a shell command without explicit escaping instructions creates a risk of command injection (e.g., using backticks or command separators like ";" or "&&").
[PROMPT_INJECTION]: The handoff mechanism uses user-supplied arguments and conversation context to seed the prompt of a secondary agent. This creates an indirect prompt injection vector where malicious data in the current session can influence or override the instructions of the next agent. The instructions also tell the agent to include a "suggested skills" section, which could be used to trick the subsequent agent into executing malicious tools.
Ingestion points: User arguments and conversation history described in SKILL.md.
Boundary markers: No specific delimiters or safety instructions are defined for the generated summary.
Capability inventory: Execution of the claude CLI via shell.
Sanitization: The instructions request redaction of sensitive info (API keys, PII), but do not include escaping of shell metacharacters or filtering of injected instructions.

claude-handoff