The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command (claude --bg --name "<descriptive name>" -- "$(cat <summary file>)") where the session name and content are dynamically generated from user input or conversation context. While the skill uses double quotes and file-based passing to mitigate expansion, an improperly sanitized descriptive name could lead to command injection if the agent includes characters like double-quotes followed by command separators.
[INDIRECT_PROMPT_INJECTION]: The skill generates a summary of the current conversation and uses it as the seed prompt for a new agent session. This creates a surface where malicious instructions embedded in the original conversation context (untrusted data) can influence or hijack the behavior of the newly launched agent.
Ingestion points: Current conversation history and user-provided arguments (SKILL.md).
Boundary markers: Absent. The summary is passed directly as a prompt without explicit delimiters or "ignore embedded instructions" warnings for the next agent.
Capability inventory: Shell command execution via the claude CLI (SKILL.md).
Sanitization: The skill provides instructions to redact sensitive information (PII, credentials), but lacks technical validation to ensure the generated summary does not contain malicious instructions.

claude-handoff