handoff
Warn
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to automate the execution of shell commands stored within markdown files. During 'resume mode', the agent finds the latest file in
.claude/handoffs/and executes every command found in the 'Verification commands' block via the Bash tool. This mechanism allows for arbitrary code execution if a user is tricked into 'resuming' from a malicious or tampered handoff file. - [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by instructing the agent to treat data from a file as trusted instructions. Specifically, the agent is told to run verification commands 'verbatim', bypassing standard safety considerations regarding the source of those commands.
- Ingestion points: Local markdown files located at
.claude/handoffs/HANDOFF-*.md. - Boundary markers: The skill lacks sanitization or validation of the commands; it explicitly instructs the agent to run them exactly as they are written in the file.
- Capability inventory: The skill leverages the agent's
Bash,Read, andWritetools to perform its tasks. - Sanitization: No validation logic is present to filter or restrict the types of commands executed from the handoff file.
Audit Metadata