40Medium
The skill implements a persistent cross-session state injection mechanism that allows malicious instructions to compromise future, unrelated user sessions.
Skill Info
Namexoonjaeho/claude-skill-handoff
Registrygithub
Version66c7723aed88
PURLpkg:github/xoonjaeho/claude-skill-handoff@66c7723aed88
Source
SHA-25699941bcb0244...
SHA-1de3a6f2f648c...
MD5ee06af0bd036...
TLSHb3b1a5992a08...
ssdeep96:gSCYO5xKc...
Size5,090 bytes
Install
This skill has findings worth reviewing before installing.
GitHub
Skills.shDocs
npx skills add https://github.com/xoonjaeho/claude-skill-handoffAssessments (3)
AI Agent Traps ↗Potential brand impersonationmediumsocial engineeringAML.T0052.000LLM09:2025
Skill name or description references a well-known AI brand, which may suggest impersonation.
70% confidence
claude
Potential for persistent state injectionmediummemory poisoningAML.T0020AML.T0070LLM04:2025LLM08:2025
The skill instructs the agent to write state to a file that is automatically re-injected into future sessions via a 'SessionStart hook'. This creates a mechanism for cross-session state persistence that could be exploited to inject instructions into new, unrelated sessions. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
70% confidenceline 3
a SessionStart hook (if installed) re-injects it into the new context and archives it.
Missing usage exampleslowpolicy violation
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
100% confidence
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/xoonjaeho/claude-skill-handoff)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/xoonjaeho/claude-skill-handoff"><img src="https://mondoo.com/ai-agent-security/api/badge/github/xoonjaeho/claude-skill-handoff.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/xoonjaeho/claude-skill-handoff.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow