claude-handoff
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions require the agent to execute a shell command:
claude --bg --name "<descriptive name>" "<handoff summary>". Because the<handoff summary>is derived from the conversation history, an attacker could include shell metacharacters (e.g., backticks, semicolons, or redirection) in the conversation to attempt command injection on the host system if the agent fails to properly escape the string.\n- [INDIRECT_PROMPT_INJECTION]:\n - Ingestion points: The entire current conversation history is used to generate the summary in
SKILL.md.\n - Boundary markers: None. The skill does not instruct the agent to use specific delimiters or escaping mechanisms to prevent the content of the summary from being interpreted as instructions by the next agent.\n
- Capability inventory: The skill invokes the
claudebinary with shell access.\n - Sanitization: The skill explicitly asks the agent to redact sensitive information like API keys and passwords, but lacks validation or sanitization rules for preventing the execution of malicious instructions embedded in the summarized data.\n- [DYNAMIC_EXECUTION]: The skill uses a command template to dynamically generate and execute a command based on conversation context. This pattern is susceptible to adversarial manipulation of the resulting command string.
Audit Metadata