Handoff

• Outcome: Review
• Latest audit: Sep 20, 2026 · 10:47 AM UTC
• Version: 0.4.1

Overview

The skill is mostly coherent, but it allows automatic invocation despite saying handoff actions should only happen on explicit request.

Install only if you are comfortable with a handoff skill that stores task records under .agents/tasks and has maintenance commands for legacy handoff cleanup. Consider changing allow_implicit_invocation to false before use, and review any npx install command or cleanup command before running it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on task-context handoff operations: saving, resuming, tidying, compressing records, and maintaining a Handoff installation. The actual code chunk is an install shell script that emits informational/error messages about retired repository protocol installation, cleanup via setup.py, and migration via migrate.py, then exits with status 2. This is a materially different primary purpose and unrelated trigger surface from the declared handoff/context-management behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on operational handoff behavior: saving/resuming task context, recording history, and compressing records for future sessions/agents. This code does not implement those functions. Instead, it implements a maintenance/migration utility to uninstall or clean up a repository-local handoff deployment after verifying file hashes and lock ownership. While the description briefly mentions 'maintaining Handoff installation,' the actual code chunk’s primary purpose is specifically removal/migration of installed handoff infrastructure, not task-context persistence or resumption. That is a materially different behavior and includes undeclared destructive capabilities such as deleting files, unlinking symlinks, and editing AGENTS.md.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on handoff/task-context management: saving, resuming, recording work history, and compressing records for a new session or agent, triggered only by explicit handoff requests. The supplied code does not implement any task-context storage, retrieval, summarization, or compression. Instead, it manages installation state by locating per-agent configuration files under the user's home/config directories, detecting legacy marker blocks, reporting status, and disabling/removing those blocks or whole files if emptied. While the description briefly mentions 'maintaining Handoff installation,' that is secondary and does not accurately represent this code chunk's primary behavior, which is specifically a config-cleanup/removal tool. Therefore the description does not accurately represent the actual behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Setting allow_implicit_invocation to true directly conflicts with the skill’s declared requirement that it be used only for explicit handoff requests. This makes accidental or model-driven activation far more likely, which is especially risky for a skill that can save, resume, compress, or reveal prior task context across sessions or agents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill metadata does not declare any tool restrictions even though the skill text indicates it may read files and trigger maintenance workflows that plausibly involve shell access. Missing scope boundaries increases the chance an agent invokes broader capabilities than intended, especially for a skill that touches task records and installation state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-facing skill content from the title onward is written in Chinese, with no indication that another language is available or that Chinese is required for a region-specific purpose. This can violate language/locale policy because it constrains interaction language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The OpenAI-facing interface broadens the skill’s stated purpose from explicit save/resume/compress handoff actions to generally 'continue or inspect a handoff task.' That mismatch can cause the orchestrator or model to invoke the skill in situations not explicitly requested by the user, exposing task context or modifying handoff state beyond the intended boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The combination of a broad default prompt ('continue the current handoff task') and implicit invocation creates ambiguous trigger conditions. In context, this is more dangerous because the skill handles persisted task history and cross-session context, so unintended activation could surface or alter sensitive work records without a clear user handoff request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The section headings and instructional text in this template are entirely in Chinese, which creates a language constraint for anyone using the skill file. Because the file does not offer a language choice or document a justified locale-specific requirement, it presents a natural-language policy violation under the language/locale rule.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The documentation instructs users to install and execute npx skills without pinning a specific version, which allows whatever version is current in the registry at execution time to run. If the package, a dependency, or the resolution path is compromised, users performing installation or maintenance could execute unexpected code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Referring again to npx skills as an installation/automation mechanism without version pinning creates a supply-chain risk because the resolved code can change over time. In a skill installer context, this is more dangerous than a passive example because the command is part of global setup and may create links or modify agent configuration directories.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/migrate.py (reported line 22)May include surrounding context.

python

OLD_TRANSACTION = ".agents/handoff.transaction"
JOURNAL = ".agents/handoff-migration.json"
FILES = {".agents/handoff/PROTOCOL.md", ".agents/handoff/ledger.sh", ".agents/tasks/TEMPLATE.md",
         ".agents/skills/handoff/SKILL.md", ".agents/skills/handoff/ledger.sh", "tools/ledger.sh"}
FRAGMENTS = {"AGENTS.md#handoff", "CLAUDE.md#handoff", ".claude/skills/handoff#target"}

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/migrate.py (reported line 127)May include surrounding context.

python

OLD_TRANSACTION = ".agents/handoff.transaction"
JOURNAL = ".agents/handoff-migration.json"
FILES = {".agents/handoff/PROTOCOL.md", ".agents/handoff/ledger.sh", ".agents/tasks/TEMPLATE.md",
         ".agents/skills/handoff/SKILL.md", ".agents/skills/handoff/ledger.sh", "tools/ledger.sh"}
FRAGMENTS = {"AGENTS.md#handoff", "CLAUDE.md#handoff", ".claude/skills/handoff#target"}

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/migrate.py (reported line 170)May include surrounding context.

python

OLD_TRANSACTION = ".agents/handoff.transaction"
JOURNAL = ".agents/handoff-migration.json"
FILES = {".agents/handoff/PROTOCOL.md", ".agents/handoff/ledger.sh", ".agents/tasks/TEMPLATE.md",
         ".agents/skills/handoff/SKILL.md", ".agents/skills/handoff/ledger.sh", "tools/ledger.sh"}
FRAGMENTS = {"AGENTS.md#handoff", "CLAUDE.md#handoff", ".claude/skills/handoff#target"}

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/migrate.py (reported line 181)May include surrounding context.

python

OLD_TRANSACTION = ".agents/handoff.transaction"
JOURNAL = ".agents/handoff-migration.json"
FILES = {".agents/handoff/PROTOCOL.md", ".agents/handoff/ledger.sh", ".agents/tasks/TEMPLATE.md",
         ".agents/skills/handoff/SKILL.md", ".agents/skills/handoff/ledger.sh", "tools/ledger.sh"}
FRAGMENTS = {"AGENTS.md#handoff", "CLAUDE.md#handoff", ".claude/skills/handoff#target"}

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/migrate.py (reported line 43)May include surrounding context.

python

def repo_root(path: Path) -> Path:
    result = subprocess.run(["git", "-C", str(path), "rev-parse", "--show-toplevel"],
                            capture_output=True, text=True, check=False)
    if result.returncode:
        raise MigrationError(f"Not a Git worktree: {path}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs irreversible cleanup actions including unlinking files, removing a symlink, deleting the journal, and rewriting AGENTS.md content. While the module docstring says it removes a handoff deployment, there is no user-facing confirmation prompt or explicit warning at the point of execution describing which files will be deleted or modified before the migration runs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring claims the tool removes only legacy user-level handoff entry blocks, but the implementation may delete the entire target file via remove_file when the result is empty. This documentation/behavior mismatch is dangerous because operators may run the script expecting a narrow edit while it performs a more destructive action.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script can delete entire per-user CLI configuration files when, after removing the marked handoff block, the remaining content is empty or whitespace. That behavior is broader than the stated purpose of removing legacy handoff blocks and creates a destructive side effect on user configuration, especially because these files may be shared or manually curated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The disable path performs destructive writes and file deletions immediately, with no interactive confirmation, dry-run output, or strong user-facing warning. In a user-level installer context that touches multiple CLI config files, this increases the chance of accidental data loss or unintended rollback-unfriendly changes if invoked incorrectly.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 7)May include surrounding context.

text

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: scripts/migrate.py:171