A cross-session handoff protocol for Claude Code and other AI agents. handoff is not a summarization tool. It's a protocol for freezing your work context, packaging it, and resuming execution — in any session, any agent, any device.

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:21 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent local handoff helper, but its saved handoff files and session identifiers should be treated as sensitive.

Install only if you are comfortable with persistent local handoff.md files. Review handoff contents before syncing or sharing them, avoid saving secrets or regulated data, prefer a local-only HANDOFF_ROOT for sensitive projects, and remove Session ID values if cross-session linkage is sensitive in your environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script collects session identifiers from environment variables and probes local ~/.claude and ~/.codex project session logs to infer a session ID, even though the skill’s stated purpose is only to manage handoff.md files. This creates unnecessary access to unrelated local AI-session metadata and can leak cross-session identifiers into generated handoff artifacts, expanding the data-access scope beyond what a user would reasonably expect from a handoff helper.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly recommends storing handoff packages in cloud-synced folders such as iCloud Drive or Dropbox, but does not warn that these files may contain sensitive prompts, project context, credentials, internal file paths, or other confidential data. Because the skill is designed for cross-session and cross-agent context transfer, the handoff content is likely to be high-value and broadly readable once synced across devices or third-party services, increasing the chance of unintended disclosure.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The `handoff out` trigger phrases include broad conversational language such as wanting to pause or continue later, which can cause the skill to activate when the user did not intend to persist session state. In a skill that writes resumable context to disk, accidental invocation can lead to unintended storage of sensitive task details or operational state.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Treating generic continuation phrases like 'continue the last session' as implicit `handoff in latest` is ambiguous and may restore the wrong package or pull prior context without sufficient user intent verification. Because restore can influence subsequent actions and file access, ambiguity increases the risk of context confusion, privacy leakage, or unintended execution against stale state.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The script reads CODEX_THREAD_ID, CODEX_TUI_SESSION_LOG_PATH, CLAUDE_SESSION_ID, and local session-log-derived identifiers without any user-facing notice in the file’s behavior. Even if only the basename/ID is used, undisclosed collection of session metadata reduces transparency and can surprise users by embedding identifiers from other tools or sessions into handoff records.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.