Install
$ agentstack add skill-milanglacier-handoff-to-claude-code-skill-handoff-to-claude-code ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Handoff to Claude Code
Delegates work to a local Claude Code session through claude -p. The user's Claude subscription pays for it, so only run it when the user asked you to.
SKILL_DIR below is the directory holding this SKILL.md; the wrapper is $SKILL_DIR/scripts/handoff.py. Run python3 $SKILL_DIR/scripts/handoff.py doctor once on a new machine to confirm the CLI is installed and logged in.
Pick a mode
| | chat | agent | | --- | --- | --- | | The deliverable is | the text Claude writes | the work Claude does on disk | | Claude may | read, search, run commands | everything, including edits | | You should | relay the text verbatim | summarize what happened |
chat withholds Edit and Write, but it can still run shell commands - so it is the right mode when nothing should change, not a guarantee that nothing can.
python3 "$SKILL_DIR/scripts/handoff.py" chat "Why does this crash on startup?"
python3 "$SKILL_DIR/scripts/handoff.py" agent "Port the auth module to the new API and run the tests"
Both commands print Claude's output, then a footer:
--- handoff metadata ---
session: 6b1c… model: claude-opus-5 cost_usd: 0.12 duration_s: 41 dir: /path
The footer is for you, not the user. Never show it to them - except model:, which is the name to use in the attribution line below. It is the model that did the work, already disambiguated from the auxiliary model that permission checking runs in the background; take it as given rather than reasoning about token counts yourself.
For a long or multi-line prompt, pass - and pipe it in:
python3 "$SKILL_DIR/scripts/handoff.py" agent -
python3 "$SKILL_DIR/scripts/handoff.py" tail -n 40
python3 "$SKILL_DIR/scripts/handoff.py" wait --timeout 600
python3 "$SKILL_DIR/scripts/handoff.py" kill
kill stops the run and everything it spawned. Use it if the user changes their mind, or if a job is stuck - a job left running keeps spending the user's subscription. status reports died for a job that vanished without finishing.
Other options
--model- override the model. Without it Claude Code uses the user's configured
default, which is usually what they want.
--yolo- run withbypassPermissionsinstead of the defaultautomode. Only when the user
asks for it or an ordinary run was blocked by permissions.
--dir- run somewhere other than the current directory.--no-auth-check- by default the wrapper stripsANTHROPIC_API_KEY/ANTHROPIC_AUTH_TOKEN
from the environment so the run bills the user's subscription rather than their API key. Pass this flag only if the user explicitly wants API-key or gateway billing.
--- anything after--(and before the prompt) goes straight toclaude.
When something fails
The wrapper prints [handoff] ERROR: … for failures that are not worth retrying - an expired login, an exhausted usage limit, a billing block. Report those to the user instead of retrying; they need a human to fix them. Other failures surface Claude's own stderr and exit status.
See reference.md in this directory for the full flag table, the permission model, and troubleshooting.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: milanglacier
- Source: milanglacier/handoff-to-claude-code-skill
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.