claude-handoff
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to launch a background process using a shell command:
claude --bg --name "<descriptive name>" "<handoff summary>". This pattern directly interpolates dynamically generated text from the conversation into a shell execution context, which is inherently risky. - [INDIRECT_PROMPT_INJECTION]: The skill ingests conversation history to generate a summary that is then used as a shell argument, creating an attack surface where external data can influence system commands.
- Ingestion points: Conversation history and user-provided arguments ingested from the session context in
SKILL.md. - Boundary markers: None. The skill relies on simple double quoting without instructions to handle embedded quotes or shell escapes.
- Capability inventory: The skill requires the capability to execute shell commands (specifically the
claudeCLI). - Sanitization: There are no instructions provided to sanitize or escape shell metacharacters (e.g., backticks, semicolons, or dollar signs) that may be present in the generated summary, allowing for potential command injection if the conversation contains malicious payloads.
Audit Metadata