claude-handoff
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the current conversation history and user-provided arguments to generate a seed prompt for a new background agent. This creates a multi-step chain where malicious instructions embedded in the initial conversation could influence the behavior of the subsequent agent session.
- Ingestion points: Current conversation history and user-supplied arguments (
SKILL.md). - Boundary markers: None specified for the generated handoff summary.
- Capability inventory: Shell command execution via the
claudeCLI tool (SKILL.md). - Sanitization: The instructions include a manual redaction requirement for sensitive info, but no programmatic escaping or sanitization is defined for the text passed to the shell.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (
claude --bg) using arguments constructed from the conversation summary. While this is the primary purpose of the skill, passing potentially unsanitized LLM-generated text into a shell environment presents a surface for command injection if the underlying platform does not handle argument escaping correctly.
Audit Metadata