claude-handoff
Warn
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to generate and run a shell command (
claude --bg --name "<descriptive name>" "<handoff summary>") where both the name and the summary are derived from the current conversation and user-provided arguments. This pattern allows for potential command injection if the content contains shell metacharacters that are not strictly sanitized or escaped by the agent before execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests history and external references to build a prompt for a new agent session, creating a vulnerability surface for indirect injection.
- Ingestion points: The current conversation history, user-provided arguments, and external files or URLs referenced in the handoff.
- Boundary markers: None; the instructions do not specify the use of delimiters to isolate the summarized content from the instructions for the new agent.
- Capability inventory: Shell command execution via the
claudeCLI to spawn background agents. - Sanitization: The skill explicitly directs the agent to remove sensitive data (API keys, passwords, PII) from the summary, which is a positive control, but it does not account for malicious instructions embedded within the conversation history that could influence the next agent's behavior.
Audit Metadata