claude-handoff
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes current conversation history to generate a summary that serves as the starting prompt for a new agent. This workflow enables a potential attack surface where malicious input within the conversation could manipulate the behavior of the recipient agent.
- Ingestion points: The agent reads the current conversation history (SKILL.md).
- Boundary markers: No explicit delimiters are specified for the transferred summary content.
- Capability inventory: The skill calls the
claude --bgshell command to initiate new agent processes (SKILL.md). - Sanitization: The instructions explicitly mandate the redaction of sensitive information, such as passwords and API keys, from the summary.
- [COMMAND_EXECUTION]: The skill utilizes a shell command (
claude --bg) to spawn background agents. It specifically mitigates command injection risks by instructing the use of double-quoted file substitution ("$(cat <file>)"), ensuring that shell-active characters like backticks or dollar signs in the conversation summary are not evaluated by the host shell.
Audit Metadata