session-handoff

ISSUES FOUND max severity HIGHSkillSpector Do not install 66 registry skills.sh last scanned 2026-02-08 1 scan

9 findings (2 high, 3 medium, 4 low), mainly data exfiltration, hardcoded secrets, policy violation. Most recent scan 2026-02-08.

The session-handoff skill is a legitimate productivity tool for managing AI agent context across sessions. It creates handoff documents containing project state, git history, and work progress. The skill demonstrates good security practices with built-in secret detection and validation. However, there are MEDIUM severity concerns around potential credential exposure through git commit messages and file path disclosure. The skill does not exhibit malicious behavior (no data exfiltration, no prompt injection, no command injection). The primary risks are unintentional information disclosure if handoff documents are mishandled. With proper user awareness and the recommended remediations, this skill is safe for use.
Scanner's overall assessment (LLM analyzer)

Findings9

Critical0

High2

Medium3

Low4

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictDo not install 66

Score66 / 100

Issues6

CategoriesDangerous Code Execution Rogue Agent Privilege Escalation

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Creates comprehensive handoff documents for seamless AI agent session transfers. Triggered when: (1) user requests handoff/memory/context save, (2) context window approaches capacity, (3) major task milestone completed, (4) work session ending, (5) user says 'save state', 'create handoff', 'I need to pause', 'context is getting full', (6) resuming work with 'load handoff', 'resume from', 'continue where we left off'. Proactively suggests handoffs after substantial work (multiple file edits, complex debugging, architecture decisions). Solves long-running agent context exhaustion by enabling…

Package: 12 files, 80 KB
SKILL.md: 777 words, 12+ sections
Code: Python (5)

SKILL.md covers: Handoff · Mode Selection · CREATE Workflow · Step 1: Generate Scaffold · Step 2: Complete the Handoff Document · Step 3: Validate the Handoff · Step 4: Confirm Handoff · RESUME Workflow · Step 1: Find Available Handoffs · Step 2: Check Staleness · Step 3: Load the Handoff · Step 4: Verify Context

Findings

HIGH Database connection string with embedded credentials Hardcoded Secretsstatic

Pattern detected: postgres://[^/\s]+:[^@

scripts/validate_handoff.py:31

(r'postgres://[^/\s]+:[^@\s]+@', "PostgreSQL connection string with password"),

Remediation: Remove credentials from connection strings

HIGH Database connection string with embedded credentials Hardcoded Secretsstatic

Pattern detected: mysql://[^/\s]+:[^@

scripts/validate_handoff.py:32

(r'mysql://[^/\s]+:[^@\s]+@', "MySQL connection string with password"),

Remediation: Remove credentials from connection strings

MEDIUM CODE EXECUTION detected by YARA Command Injectionstatic

Detects dangerous code execution patterns in agent skills (Python/Bash): subprocess.run(

evals/setup_test_env.py:29

subprocess.run(cmd, cwd=cwd, capture_output=True, check=True)

Remediation: Review and remove code execution pattern

MEDIUM Potential Credential Exposure in Git Log Capture Data Exfiltrationllm

The create_handoff.py script captures recent git commit messages and modified files without filtering. If developers include sensitive information in commit messages (API keys, passwords, internal URLs, etc.), this data will be written to handoff documents. The script runs 'git log -10' and includes full commit messages in the generated handoff file.

scripts/create_handoff.py

result = subprocess.run(['git', 'log', '-10', '--oneline'], ...) captures commit messages that may contain secrets. No filtering or sanitization is applied before writing to handoff document.

Remediation: Add commit message sanitization to detect and redact potential secrets before including in handoff documents. Warn users if sensitive patterns are detected in git history. Consider using the same SECRET_PATTERNS from validate_handoff.py to scan commit messages.

MEDIUM File Path Disclosure in Handoff Documents Data Exfiltrationllm

The scripts capture and store absolute file paths, git branch names, and project directory structures in handoff documents. While this is necessary for functionality, it exposes internal project organization and potentially sensitive directory names (e.g., /home/username/secret-project/). If handoff documents are shared externally or committed to public repositories, this constitutes information disclosure.

scripts/create_handoff.py

project_path = os.getcwd() and full absolute paths are written to handoff documents without sanitization. Branch names and directory structures are exposed in metadata sections.

Remediation: Add a warning in documentation that handoff documents contain project metadata and should not be shared publicly. Consider adding an option to generate 'sanitized' handoffs with relative paths only. Add .claude/handoffs/ to .gitignore recommendations.

LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

LOW Unbounded Git Log Retrieval Resource Abusellm

The check_staleness.py script retrieves git commits since handoff creation without limiting the number of commits. For long-running projects or old handoffs, this could retrieve thousands of commits, causing performance issues or resource exhaustion.

scripts/check_staleness.py

git log command uses '--since' parameter without '--max-count' limit. For a handoff created months ago, this could retrieve unlimited commits.

Remediation: Add a reasonable limit to git log queries (e.g., --max-count=100) and warn users if the limit is reached. Display a message like 'More than 100 commits since handoff - showing first 100'.

LOW Missing allowed-tools Declaration Data Exfiltrationllm

The skill manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills specification, declaring it would improve transparency about which agent capabilities this skill requires (Read, Write, Bash, Python).

SKILL.md

YAML manifest shows: allowed-tools: Not specified. The skill uses Python scripts extensively and reads/writes files.

Remediation: Add 'allowed-tools: [Read, Write, Bash, Python]' to the YAML frontmatter to explicitly declare required agent capabilities.

LOW Secret Detection Patterns May Have False Negatives Data Exfiltrationllm

The validate_handoff.py script includes secret detection patterns, but the patterns may not catch all secret formats (e.g., AWS access keys, Azure connection strings, JWT tokens, etc.). The validation provides a false sense of security if users rely solely on it.

scripts/validate_handoff.py

SECRET_PATTERNS list covers common cases but is not comprehensive. Missing patterns for: AWS keys (AKIA...), Azure keys, GCP service account keys, JWT tokens, SSH private keys in non-PEM format.

Remediation: Expand SECRET_PATTERNS to include more secret formats. Add a disclaimer that validation is not foolproof and users should manually review handoffs for secrets. Consider integrating with dedicated secret scanning tools like truffleHog or gitleaks.

What is in the package

File	Kind	Size
`README.md`	doc	6.9 KB
`SKILL.md`	doc	6.2 KB
`evals/model-expectations.md`	doc	5.6 KB
`evals/results-opus-baseline.md`	doc	2.6 KB
`evals/setup_test_env.py`	script	10 KB
`evals/test-scenarios.md`	doc	5.2 KB
`references/handoff-template.md`	doc	3.9 KB
`references/resume-checklist.md`	doc	2.7 KB
`scripts/check_staleness.py`	script	13 KB
`scripts/create_handoff.py`	script	10 KB
`scripts/list_handoffs.py`	script	3.7 KB
`scripts/validate_handoff.py`	script	11 KB

External hosts referenced

jwt.io

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

DATABASE_URL JWT_SECRET

Package contents recorded 2026-10-22 at commit b00cf8491de1. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://github.com/softaworks/agent-toolkit
Raw scan result: session-handoff-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/skills-sh-session-handoff.svg)
Request a re-scan