handoff — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited handoff (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Compact the current conversation into a single self-contained Markdown document that a fresh agent can read at the start of the next session and immediately know: what to do, what's already done, what's blocked, and which skills/files to touch. Save it to the OS temp directory (NOT the workspace) so it doesn't accidentally get committed.
The handoff doc is a briefing, not a transcript. It references — never duplicates — content that already lives in other artifacts (PRs, plans, design docs, commits, memory entries, ADRs, issue trackers).
See [README.md](README.md) for the credit (Matt Pocock's original `handoff`) and install / use instructions.
Fire on any of:
/handoff (optionally with an argument describing the next session's focus).docs/, project-management/, or architecture/), not in /tmp.If the user passed an argument to /handoff (or named the next session's focus in their message), treat it as the mission statement. The whole doc tailors to that mission.
Examples of argument shapes you might see:
/handoff respond to Codex's review on PR #364 → mission = "respond to Codex review, then merge"/handoff and create a skill for X → mission = "create the X skill"/handoff continue Slice 3 → mission = "implement Slice 3 of the current epic"The user is checking out; don't make them answer questions. Mine the state yourself:
git status --short
git log --oneline -10
git branch --show-current
gh pr list --repo <owner/repo> --author "@me" --state open
gh pr view <N> --json state,reviewDecision,mergeStateStatus,headRefOid # for each in-flight PR
date -u +"%Y-%m-%dT%H:%M:%SZ" # timestampAlso scan the recent conversation for:
OS temp directory, NOT the workspace. On macOS the canonical user-facing temp is /tmp/ (symlinked to $TMPDIR for the user's session). On Linux, /tmp/ is standard. Filename pattern:
/tmp/handoff-<short-kebab-slug>-<YYYY-MM-DD>.mdWhere <short-kebab-slug> is 3–5 words summarising the next session's focus (e.g. slice-3-and-skill, respond-codex-pr-364, bootstrap-rebuild).
If /tmp/ doesn't exist or isn't writable (rare), fall back to $(mktemp -d)/handoff.md and report that path.
Never write to:
./, ../, anywhere under the current project).~/.claude/.~/.claude/plans/ (that's for plan-mode artifacts; handoffs are not plans).Before writing a single line of doc body, enumerate every artifact that already captures something you'd otherwise restate. Reference these by path or URL; don't paraphrase their content.
| Artifact type | Common locations | How to reference |
|---|---|---|
| Design docs | docs/design/**/*-design.md, project-management/**/*-design.md, architecture/**/*.md, ADR folders | Path + section anchor (e.g. docs/design/foo-design.md §4.5) |
| Implementation plans | <docs-folder>/**/*-plan.md | Same |
| Peer-review threads (Codex, another Claude, human reviewer) | <repo>/.dialogue/*-review-thread.md, <docs-folder>/**/*-review-thread.md | Path; note whether closed (Final ACK both sides) or open |
| Open PRs | GitHub / GitLab | URL + PR number; cite head SHA |
| Merged PRs | Same | URL + merge commit SHA |
| Recent commits worth flagging | git history | SHA + one-line subject |
| Auto-memory entries | ~/.claude/projects/<project>/memory/*.md | Filename only (no body) — the next agent reads MEMORY.md on session start |
| Per-package / per-module specs | packages/<pkg>/{SPEC,CLAUDE}.md, apps/<name>/CLAUDE.md, <module>/SPEC.md | Path; note "assume loaded" for the next session |
| Plan files from plan-mode | ~/.claude/plans/<name>.md | Path; note approval status |
If you find yourself wanting to write out a 10-bullet summary of a doc, stop and reference the doc instead. The next agent reads what they need; pre-digesting wastes context.
Canonical structure — adapt section names but keep this order:
# Handoff — <one-line mission> (<YYYY-MM-DD>)
**Repo**: <absolute path> (one-line description)
**Branch at handoff**: `<branch>` (clean | dirty: <files>)
**Working tree**: <state as of timestamp>
## Mission for next session
<2–4 sentences. Lead with the action verb. If the user passed an argument,
this section is shaped around it. If multiple parallel tracks, name them
1. ... 2. ... so the next agent can pick one or run them concurrently.>
## Where we are
### Recent merge / open PR / pending work
<Table: work item × PR/branch × status × one-line note. Cite SHAs.>
### Canonical artifacts to read first
<Bullet list of paths/URLs the next agent MUST read before doing anything.
Order them by load-bearingness — most critical first.>
## Active work / context anchors
<For each in-flight thread, name:
- What it is + its current state (1–2 sentences)
- Where the canonical record lives (path/URL)
- Anything the next agent would otherwise have to reconstruct from this
conversation. THIS is the section where transient session knowledge
gets persisted; everything else is references.>
### Anticipated review push-back (when waiting on a peer review)
<If a PR is awaiting Codex or another reviewer, list the 2–4 specific
things you'd anticipate getting flagged, with defensive answers prepped.
This is the highest-value addition over what's already on disk.>
### Key memories worth recalling
<Table: filename × one-line summary. NEVER quote memory bodies. List
only the entries that materially shaped recent decisions; the next agent
loads the full index from MEMORY.md on session start.>
## Suggested skills
<Mandatory section. Table: skill name × why this session needs it.
Order by likely-first-invoked. Include the user-feedback skills
(`grill-me` before finalising plans, `pair-agent-harness` for Codex /
peer-review threads, etc.) that match the mission.>
## Open questions / decisions for the next session
<Numbered list of things you couldn't resolve without the user. Each item:
- The question (concrete, one sentence)
- The options you considered + your recommended call (if any)
- Why it's blocking (or note "non-blocking; can proceed without")>
## How to start the next session cleanly
<3–5 numbered steps. Almost always:
1. Read these CLAUDE.md files: ...
2. Read this handoff doc.
3. Check the in-flight PR / review thread / blocked task.
4. Invoke <primary skill> with <opening intent>.>
## Hand-off complete checklist
- [x] Branch state clean OR uncommitted changes documented above.
- [x] In-flight PR description has the full state-of-play; no comments need response from THIS session.
- [x] No secrets / PII in this doc.
- [x] References (not duplication): all canonical artifacts cited with paths/URLs/SHAs.
---
*Generated <ISO-8601 UTC timestamp>. Source conversation covered:
<one-line topic list>.*Scan the draft for sensitive content before writing:
sk-, whsec_, pk_, xoxb-, ghp_, eyJ, JWT-shaped tokens, anything from an .env example. Redact to <REDACTED> or <example-key>.postgres://user:PASS@host/db → postgres://<REDACTED>@host/db.When in doubt, redact. Note redactions in a final line: *Redacted: <count> credentials and <count> PII items.*
End the chat reply with:
Handoff doc written to <absolute-path>.Optionally add 2–3 sentences summarising the doc's structure (mission + the highest-value addition the doc makes vs. what's already on disk). Don't paste the doc body into chat — it's already in the file.
The most recently written handoff (a worked example you can mimic) is at the path the user last invoked /handoff against. If that's not accessible:
docs/, project-management/, architecture/, alongside code).MEMORY.md loads automatically on session start.grill-me for plans, pair-agent-harness for any peer review, the most-recently-used domain skill). This section is what makes handoffs re-bootable.Before reporting the path to the user, verify:
/tmp/ or $TMPDIR), NOT the workspace.handoff-<slug>-<YYYY-MM-DD>.md.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.