40Medium
The skill facilitates cross-session prompt injection by allowing arbitrary local file state to be loaded into new contexts, posing a significant risk of malicious instruction poisoning.
Skill Info
Namexoonjaeho/claude-skill-handoff
Registrygithub
Version66c7723aed88
PURLpkg:github/xoonjaeho/claude-skill-handoff@66c7723aed88
Source
SHA-25699941bcb0244...
SHA-1de3a6f2f648c...
MD5ee06af0bd036...
TLSHb3b1a5992a08...
ssdeep96:gSCYO5xKc...
Size5,090 bytes
Install
This skill has findings worth reviewing before installing.
GitHub
Skills.shDocs
npx skills add https://github.com/xoonjaeho/claude-skill-handoffAssessments (3)
AI Agent Traps ↗Potential brand impersonationmediumsocial engineeringAML.T0052.000LLM09:2025
Skill name or description references a well-known AI brand, which may suggest impersonation.
70% confidence
claude
Persistence of state across sessionsmediummemory poisoningAML.T0020AML.T0070LLM04:2025LLM08:2025
The skill implements a mechanism to inject arbitrary state from a local file into a new session context, which could be exploited to inject malicious instructions or 'poison' the agent's memory across session boundaries. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
80% confidenceline 3
a SessionStart hook (if installed) re-injects it into the new context
Missing usage exampleslowpolicy violation
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
100% confidence
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/xoonjaeho/claude-skill-handoff)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/xoonjaeho/claude-skill-handoff"><img src="https://mondoo.com/ai-agent-security/api/badge/github/xoonjaeho/claude-skill-handoff.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/xoonjaeho/claude-skill-handoff.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow