claude-handoff
Warn
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill summarizes the current conversation for use as a primary prompt for a new agent, creating a hijacking surface for instructions embedded in conversation history.
- Ingestion points: conversation history and user arguments are summarized to generate the prompt.
- Boundary markers: none specified to isolate untrusted content from the new agent's system instructions.
- Capability inventory: shell command execution via the 'claude' CLI tool.
- Sanitization: includes a basic instruction to redact secrets, which does not prevent instruction-based prompt injection.
- [DATA_EXFILTRATION]: The skill saves conversation data to the system's temporary directory, making it potentially accessible to other local processes and users, which constitutes a local data exposure risk.
- [COMMAND_EXECUTION]: The instruction to use $(cat ) within a shell command introduces a risk of unintended command execution if shell quoting is not perfectly maintained or if environment-specific expansion occurs on the content of the summary file.
Audit Metadata