hooks — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hooks (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Preserve and restore context between Claude Code sessions.
When working with Claude Code across multiple sessions, switching agents, or hitting context limits (auto-compaction), valuable context is lost:
Handoff captures "necessary and sufficient" context to a docs/handoff/HANDOFF.md file, enabling seamless continuation across sessions.
# Add the marketplace
/plugin marketplace add thepushkarp/handoff
# Install the plugin
/plugin install handoff@handoff/handoff:createCapture current session context to docs/handoff/HANDOFF.md.
What it captures:
Usage:
/handoff:createThe handoff is appended with a timestamp, creating a history log.
/handoff:resumeLoad existing handoff context to continue work.
Default mode: Displays handoff summary and asks how to proceed.
/handoff:resumeAuto mode: Automatically loads context and starts working on next steps.
/handoff:resume --autoThe plugin includes always-on hooks that make compaction safe:
PreCompact): appends a new entry to docs/handoff/HANDOFF.md with deterministic snapshot data and placeholders for a model-written summary/context.SessionStart matcher compact): auto-injects the latest handoff entry back into Claude's context (stdout injection).Stop): if the latest entry still has TODO placeholders for Model Summary and Handoff Context, Claude is blocked from stopping (up to 3 attempts) until it fills them in.This ensures you never lose important context to auto-compaction.
Note: These scripts usejqwhen available to parse hook input and transcripts. Withoutjq, the plugin degrades gracefully but will capture less detail.
Handoffs are stored in docs/handoff/HANDOFF.md with timestamped entries:
---
## Handoff: 2025-01-05 14:32:00
### Current Task State
Implementing user authentication feature. Login flow is complete, working on password reset.
### Key Decisions
- Using JWT for session tokens: Better for stateless scaling
- Email verification required: Security requirement from product
### Modified Files
- `src/auth/login.ts` - Added JWT generation
- `src/auth/middleware.ts` - Token validation middleware
- `tests/auth.test.ts` - Login flow tests
### Blockers / Open Questions
- Need to decide on password reset token expiry (1hr vs 24hr?)
### Next Steps
1. Implement password reset endpoint
2. Add email sending for reset tokens
3. Write tests for reset flow
### Critical Context
- The `AUTH_SECRET` env var must be set or tests fail silently
- Rate limiting is handled in nginx, not in code
### Model Summary
- Login flow is complete; password reset in progress
- Using JWT sessions for stateless scaling
- Blocker: decide reset token expiry (1h vs 24h)
### Handoff Context (paste into next session)
1. Open `docs/handoff/HANDOFF.md` and focus on the most recent entry.
2. Implement password reset endpoint and tests first.
3. Confirm `AUTH_SECRET` is set before running tests.
---/handoff:create before closing Claude Codedocs/handoff/HANDOFF.md for async collaboration/handoff:resume when starting a new sessionClaude Code supports project-level compaction guidance via a CLAUDE.md section named # Compact instructions:
# Compact instructions
When compacting, preserve:
- the latest handoff entry in docs/handoff/HANDOFF.md
- current task state, blockers, and next steps
- key decisions and constraintsClaude Code caches plugin content by version. When you change plugin code, bump the version in plugins/handoff/.claude-plugin/plugin.json so existing users receive the update.
Useful commands when developing:
# Validate manifests and marketplace structure
/plugin validate
# If testing a local plugin directory (see Claude Code docs for the exact flag usage)
claude --plugin-dir ./plugins/handoffMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.