Install
$ agentstack add skill-aploe-claude-handoff-skill-handoff-write ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Handoff Write
Produce a self-instructing handoff document that any LLM agent can pick up — Claude Code, Codex, Cursor, Gemini, GPT — even ones that have never heard of this plugin. The doc carries its own pickup protocol at the top (bootstrap block).
Always do this first
Before any action, read in this order:
references/instructions.md— heuristics for depth, pre-flight gates, file/git resolution, redaction rules, INDEX writing, output report shape.references/template.md— canonical doc structure (sections, per-depth inclusion, slug rules).references/bootstrap.md— the literal block to inject at the very top of every doc.
Do not skip the read step. The dispatcher below is intentionally minimal — every operational detail lives in references/.
Universal rules
- Paths use absolute form in INDEX and user-facing output. Relative paths only inside the workspace
.handoffs/directory. - Timestamps are local time in
YYYY-MM-DD HH:MMformat, no timezone suffix. ALWAYS obtain the current time by runningdate '+%Y-%m-%d %H:%M'— never estimate it from conversation context. - Redact secrets aggressively — API keys, tokens, passwords, bearer headers,
.envvalues, internal IPs, third-party emails/PII. Replace with>. Never let a secret reach the doc, even if the user pasted it earlier in the conversation. - Don't duplicate content already in a Plan, PRD, ADR, Issue, commit, or diff. Reference by path/URL/SHA. The one exception is verbatim user-quote constraints in Section 4 — those are duplicated on purpose because the receiver needs them inline.
- No emojis in file content beyond the template's ✅/🔄/⏸️ status markers.
- Output language follows the user's conversation language for the doc body and user-facing skill output. The bootstrap block stays English — it's the agent-to-agent protocol; keeping it monolingual maximizes pickup reliability across diverse LLMs.
- Two storage locations are touched: workspace
/.handoffs/.md(the doc) and a central index file ($HANDOFF_INDEX_PATHor~/.claude/handoffs/INDEX.md). Both must stay in sync; if one write fails, surface the inconsistency to the user. - Mention the related sub-skills in the report:
/handoff-resumefor pickup,/handoff-listto browse,/handoff-archiveto clean up.
Pre-flight confirmation gates
Confirm with the user BEFORE writing only in these cases:
- Depth was bumped to
exhaustive(potentially large doc — user should know first). .handoffs/doesn't exist yet in this repo (first-time setup deserves a heads-up).
In all other cases, write immediately and report. Friction-free for the common case.
Versioning
Bootstrap block carries `` marker. Future schema changes bump to v2; resume reads the version and dispatches accordingly. Current version: v1.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: aploe
- Source: aploe/claude-handoff-skill
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.