Skip to content
skillsafebeta
← Report library
Purpose / Other

Claude Handoff Skill Security Audit

What the author says it does (original text)

Hand the current conversation off to a fresh background agent that picks up the work immediately.

Independent security check

Do not install or run it yet

Files checked
2
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
High risk

Conversation text is embedded in a shell command, enabling possible command injection

Source references: 2
What we found

The prescribed command places a generated name and handoff summary inside double-quoted shell arguments without requiring safe argument passing or escaping. The summary is also tailored from user arguments, so it can contain quotes, backticks, `$()`, or other shell syntax. Double quotes do not prevent command substitution and can be terminated by embedded quotes.

Why this matters

If an agent constructs and executes the command through a shell as shown, crafted conversation text or arguments could run additional commands with the user's permissions, potentially reading or changing files, using available credentials, or starting unintended processes.

The skill explicitly requests a shell-form command with a model-generated name and handoff summary interpolated into double-quoted arguments. User arguments also influence the summary. If the runner constructs this as shell text and the content contains an unescaped `"`, `$()`, or backticks, unintended commands could run and affect user files or credentials. The source does not require an argument-array API or robust escaping; users can ask the author to avoid shell interpolation and restrict name characters.

SKILL.md:8In the instructionsOpen original file
Write a handoff summary of the current conversation so a fresh agent can continue the work. Instead of saving it, launch a background agent seeded with the summary as its prompt: `claude --bg --name "<descriptive name>" "<handoff summary>"`. It starts in the current working directory and returns immediately; the user manages it with `claude agents`.
Show 1 other places
SKILL.md:18In the instructionsOpen original file
If the user passed arguments, treat them as a description of what the next session will focus on and tailor the summary accordingly.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The handoff sends current-conversation content into another agent session

Source references: 5
What we found

The summary becomes the prompt of a new background agent. Although the instructions require redacting keys, passwords, and personal data, they do not require user review and do not cover every unrecognized secret, private source excerpt, customer record, or business confidential detail.

Why this matters

After invocation, sensitive context retained in the summary enters another agent session, which may also follow referenced paths in the current working directory. This expands data handling beyond the current session.

Legitimate use of this code

Passing a summary of the current conversation to a fresh background agent is the skill’s disclosed core purpose, not a hidden transfer. Its policy also disallows implicit invocation, so the user must explicitly trigger it, and the instructions require redacting API keys, passwords, and personally identifiable information. A summary could still contain unrecognized proprietary material, but the evidence does not show transfer to another account or unauthorized third party; users can request a reference-only summary or preview before invocation.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:8In the instructionsOpen original file
Write a handoff summary of the current conversation so a fresh agent can continue the work. Instead of saving it, launch a background agent seeded with the summary as its prompt: `claude --bg --name "<descriptive name>" "<handoff summary>"`. It starts in the current working directory and returns immediately; the user manages it with `claude agents`.
Show 4 other places
SKILL.md:14In the instructionsOpen original file
Do not duplicate content already captured in other artifacts (specs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.Redact any sensitive information, such as API keys, passwords, or personally identifiable information, since the summary becomes the agent's prompt.
SKILL.md:3In the instructionsOpen original file
name: claude-handoffdescription: Hand the current conversation off to a fresh background agent that picks up the work immediately.argument-hint: "What will the next session be used for?"
SKILL.md:16In the instructionsOpen original file
Redact any sensitive information, such as API keys, passwords, or personally identifiable information, since the summary becomes the agent's prompt.
agents/openai.yaml:5In the instructionsOpen original file
policy:  allow_implicit_invocation: false
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

0 instruction sections

When explicitly invoked, the Skill summarizes the current conversation and starts a named `claude` background agent in the current working directory; the command returns immediately and the user manages it through `claude agents`.

View source
SKILL.md:8In the instructionsOpen original file
Write a handoff summary of the current conversation so a fresh agent can continue the work. Instead of saving it, launch a background agent seeded with the summary as its prompt: `claude --bg --name "<descriptive name>" "<handoff summary>"`. It starts in the current working directory and returns immediately; the user manages it with `claude agents`.
agents/openai.yaml:4In the instructionsOpen original file
  short_description: "Hand off to a background agent"policy:  allow_implicit_invocation: false

The handoff summary tells the next agent which Skills are suggested and references existing artifacts by path or URL instead of duplicating their contents.

View source
SKILL.md:12In the instructionsOpen original file
Include a "suggested skills" section in the summary, naming which skills the next agent should call the Skill tool for.Do not duplicate content already captured in other artifacts (specs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.

The instructions require API keys, passwords, and personally identifiable information to be redacted before the summary becomes the new agent's prompt.

View source
SKILL.md:16In the instructionsOpen original file
Redact any sensitive information, such as API keys, passwords, or personally identifiable information, since the summary becomes the agent's prompt.
Start here · InstructionsSKILL.md
claude-handoff

The instructions have no section headings. Supporting files and code excerpts are available below.

Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • agents/openai.yamlFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • agents/openai.yamlSupporting file
Lines read
25
File checksum (to compare versions)
3060a453861871cb6da9ff8306356b38f08cc8b4d3696f8804d17d8ef0ab03c1