← Back to Skills Marketplace
926
Downloads
0
Stars
5
Active Installs
1
Versions
Install in OpenClaw
/install session-handoff
Description
WHAT: Create comprehensive handoff documents that enable fresh AI agents to seamlessly continue work with zero ambiguity. Solves long-running agent context exhaustion problem.
WHEN: (1) User requests handoff/memory/context save, (2) Context window approaches capacity, (3) Major task milestone completed, (4) Work session ending, (5) Resuming work with existing handoff.
KEYWORDS: "save state", "create handoff", "context is full", "I need to pause", "resume from", "continue where we left off", "load handoff", "save progress", "session transfer", "hand off"
Usage Guidance
This skill appears to do what it says: scaffold, validate, list, and evaluate 'handoff' markdown files using local git and filesystem checks. Before installing or running it: (1) Review the scripts yourself (they live in scripts/) if you have sensitive projects — they will create files under .claude/handoffs/ and run git commands in the project directory. (2) Be cautious running the example shell commands (env | grep, ps aux | grep) on machines with secrets; they can expose environment values or process information. (3) The README suggests installing from a GitHub URL — only run external install commands after reviewing/validating the remote repo. (4) The validator looks for likely secrets with regexes but can yield false positives/negatives, so manually verify any flagged content before committing or sharing handoffs. Overall the footprint is local and proportional to the stated purpose.
Capability Analysis
Type: OpenClaw Skill
Name: session-handoff
Version: 0.1.0
The OpenClaw AgentSkills skill bundle is designed for legitimate context management and handoff creation. However, the `scripts/validate_handoff.py` script contains a path traversal vulnerability. Specifically, the `check_file_references` function, when parsing file paths from a handoff document, does not adequately sanitize paths, allowing `../` sequences. This could enable a malicious handoff document to check for the existence of arbitrary files outside the project directory (e.g., `/etc/passwd`) on the agent's system, leading to an information disclosure vulnerability.
Capability Assessment
Purpose & Capability
Name/description (session handoff) match the included scripts and docs. The scripts create, validate, list, and check staleness of handoff markdown files in .claude/handoffs/, and they use git metadata — all expected for this purpose.
Instruction Scope
SKILL.md directs the agent to run the bundled Python scripts and to open/edit the generated files; scripts only inspect local repo state and files and check for secrets. Minor scope notes: quick-start commands in the resume checklist include commands like `env | grep [relevant-var]` and `ps aux | grep [process-name]` which can reveal environment variable values or process details if run verbatim — these are reasonable for debugging but operators should be careful about running them in environments where secrets or sensitive processes are present.
Install Mechanism
There is no formal install spec in the skill bundle (instruction-only at runtime), which minimizes automatic install risk. README includes manual install instructions and an `npx add https://github.com/...` example pointing to an external repo; that is an out-of-band install suggestion (not executed by the skill) — users should vet any external repo URL before running install commands.
Credentials
The skill requires no environment variables, credentials, or special config paths. Scripts operate on local filesystem and git; secret-detection is built into validation. No unrelated credentials are requested in code or SKILL.md.
Persistence & Privilege
Skill does not request always:true, does not modify other skills, and only writes its own files under .claude/handoffs/ in the project. It uses subprocess git calls but does not attempt to persist credentials or alter global agent settings.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install session-handoff - After installation, invoke the skill by name or use
/session-handoff - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.0
Initial release: provides structured workflows for creating and resuming session handoffs to prevent context loss in long-running tasks.
- Introduces CREATE and RESUME workflows for saving and restoring project state.
- Scripts for scaffold generation, validation, listing, and staleness checking included.
- Defines handoff document quality criteria and automated validation with scoring.
- Supports chained handoffs for projects requiring ongoing context preservation.
- Adds clear guidance to prevent secrets leakage and enforce handoff completeness.
Metadata
Frequently Asked Questions
What is Session Handoff?
WHAT: Create comprehensive handoff documents that enable fresh AI agents to seamlessly continue work with zero ambiguity. Solves long-running agent context exhaustion problem. WHEN: (1) User requests handoff/memory/context save, (2) Context window approaches capacity, (3) Major task milestone completed, (4) Work session ending, (5) Resuming work with existing handoff. KEYWORDS: "save state", "create handoff", "context is full", "I need to pause", "resume from", "continue where we left off", "load handoff", "save progress", "session transfer", "hand off". It is an AI Agent Skill for Claude Code / OpenClaw, with 926 downloads so far.
How do I install Session Handoff?
Run "/install session-handoff" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Session Handoff free?
Yes, Session Handoff is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Session Handoff support?
Session Handoff is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Session Handoff?
It is built and maintained by wpank (@wpank); the current version is v0.1.0.
More Skills