handoff-claude-session
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses Claude session logs stored in the user's home directory. These logs contain a record of all interactions, tool usage, and code, which can contain sensitive project details.\n
- Evidence: The script
scripts/extract_session.pyexpands the user path to access~/.claude/projects/.\n - Mitigation: The instructions explicitly command the agent to redact credentials, tokens, and private keys before finalizing the handoff document.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes session history that includes data from external tools and user-provided inputs, creating a surface for indirect prompt injection if malicious instructions were present in the logs.\n
- Ingestion points: JSONL session logs located in
~/.claude/projects/.\n - Boundary markers: Absent. The extracted log content is parsed into a transcript without specific 'ignore instructions' delimiters for the log entries.\n
- Capability inventory: The skill utilizes filesystem read access and executes a local Python script to extract data.\n
- Sanitization: Instructions mandate redaction of sensitive data and focus the agent on objective operational summaries.\n- [COMMAND_EXECUTION]: The skill runs a bundled Python script to handle log extraction.\n
- Evidence:
SKILL.mdspecifies the execution ofpython3 scripts/extract_session.py.\n - Security Note: The script includes validation to ensure the session ID is a valid UUID, reducing the risk of argument injection.
Audit Metadata