command-development

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
11
Flagged
11
Chunks
26
Flagged Files (11)
README.mdHIGH
78.3%

Malicious tool definition detected

Tool: README.md Description: # Command Development Skill Comprehensive guidance on creating Claude Code slash commands, including file format, frontmatter options, dynamic arguments, and best practices.

SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/3] Description: --- name: command-development description: This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction

Tool: SKILL.md [2/3] Description: - Gather project/repository state - Build context-aware workflows **Implementation details:** For complete syntax, examples, and best practices, see `references/plugin-features-reference.md` section on bash execution. The reference includes the exact syntax and multiple working examples to avoid execution issues ## Command Organization ### Flat Structure Simple organization for small command sets: ``` .claude/commands/ ├── build.md ├── test.md ├── deploy.md ├──

Tool: SKILL.md [3/3] Description: argument-hint: [api-file] --- Document API in @$1 following plugin standards.

examples/plugin-commands.mdHIGH
78.3%

Malicious tool definition detected

Tool: examples/plugin-commands.md [1/2] Description: # Plugin Command Examples Practical examples of commands designed for Claude Code plugins, demonstrating plugin-specific patterns and features. ## Table of Contents 1. [Simple Plugin Command](#1-simple-plugin-command) 2.

Tool: examples/plugin-commands.md [2/2] Description: Command **Use case:** Command with input validation and error handling **File:** `commands/build-env.md` ```markdown --- description: Build for specific environment with validation argument-hint: [environment] allowed-tools: Bash(*) --- Validate environment argument: !`echo "$1" | grep -E "^(dev|staging|prod)$" && echo "VALID" || echo "INVALID"` Check build script exists: !`test -x ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh && echo "EXISTS" || ech

examples/simple-commands.mdHIGH
78.3%

Malicious tool definition detected

Tool: examples/simple-commands.md [1/2] Description: # Simple Command Examples Basic slash command patterns for common use cases. **Important:** All examples below are written as instructions FOR Claude (agent consumption), not messages TO users.

Tool: examples/simple-commands.md [2/2] Description: 4: Multiple Arguments ```markdown --- argument-hint: [source] [target] [options] --- Process $1 to $2 with $3...

references/advanced-workflows.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/advanced-workflows.md [1/2] Description: # Advanced Workflow Patterns Multi-step command sequences and composition patterns for complex workflows. ## Overview Advanced workflows combine multiple commands, coordinate state across invocations, and create sophisticated automation sequences.

Tool: references/advanced-workflows.md [2/2] Description: --- description: Generate release notes allowed-tools: Read, Bash(git:*) --- Checking for completed features... if [ -f .claude/feature-complete.flag ]; then Feature ready for release notes fi [Include in release notes] ``` ### Workflow Locking Prevent concurrent workflow execution: ```markdown --- description: Start deployment allowed-tools: Read, Write, Bash --- # Start Deployment Checking for active deployments... if [ -f .claude/deplo

references/documentation-patterns.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/documentation-patterns.md [1/3] Description: # Command Documentation Patterns Strategies for creating self-documenting, maintainable commands with excellent user experience. ## Overview Well-documented commands are easier to use, maintain, and distribute.

Tool: references/documentation-patterns.md [2/3] Description: be partially applied - System may be in inconsistent state - Manual intervention may be needed RECOVERY STEPS: 1. Check operation logs: cat /tmp/operation.log 2.

Tool: references/documentation-patterns.md [3/3]

references/frontmatter-reference.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/frontmatter-reference.md [1/2] Description: # Command Frontmatter Reference Complete reference for YAML frontmatter fields in slash commands.

Tool: references/frontmatter-reference.md [2/2] Description: - All tests passed - Security scan clean - Stakeholder approval - Rollback plan ready Type "APPROVED" to confirm deployment.

references/interactive-commands.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/interactive-commands.md [1/3] Description: # Interactive Command Patterns Comprehensive guide to creating commands that gather user feedback and make decisions through the AskUserQuestion tool.

Tool: references/interactive-commands.md [2/3] Description: --- description: Multi-question configuration allowed-tools: AskUserQuestion, Write --- # Project Configuration Setup Gather configuration through multiple questions.

Tool: references/interactive-commands.md [3/3] Description: type checking) - Black (Code formatting) - Pylint (Linting and style) Questions adapt to project context.

references/marketplace-considerations.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/marketplace-considerations.md [1/3] Description: # Marketplace Considerations for Commands Guidelines for creating commands designed for distribution and marketplace success.

Tool: references/marketplace-considerations.md [2/3] Description: plugin version: >= 2.0.0 - Breaking changes from v1.x documented in MIGRATION.md VERSION HISTORY: - v2.1.0: Added --new-feature flag - v2.0.0: BREAKING: Changed argument order - v1.0.0: Initial release --> # Version Check Command version: 2.1.0 Plugin version: [detect from plugin.json] if [ "$PLUGIN_VERSION" < "2.0.0" ]; then ❌ ERROR: Incompatible plugin version This command requires plugin version >= 2.0.0 Current version: $PLUGI

Tool: references/marketplace-considerations.md [3/3] Description: --- # Check for Updates Current version: 2.1.0 Latest version: [check if available] if [ "$CURRENT_VERSION" != "$LATEST_VERSION" ]; then 📢 UPDATE AVAILABLE New version: $LATEST_VERSION Current: $CURRENT_VERSION What's new: - Feature improvements - Bug fixes - Performance enhancements Update with: /plugin update plugin-name Release notes: https://releases.example.com/v$LATEST_VERSION fi [Command continues...] ``` ## Best Practices

references/plugin-features-reference.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/plugin-features-reference.md [1/2] Description: # Plugin-Specific Command Features Reference This reference covers features and patterns specific to commands bundled in Claude Code plugins. ## Table of Contents - [Plugin Command Discovery](#plugin-command-discovery) - [CLAUDE_PLUGIN_ROOT Environment Variable](#claude_plugin_root-environment-variable) - [Plugin Command Patterns](#plugin-command-patterns) - [Integration with Plugin Components](#integration-with-plugin-components)

Tool: references/plugin-features-reference.md [2/2] Description: use Task tool to launch agent - Agent has access to same plugin resources ### Invoking Plugin Skills Commands can reference plugin skills for specialized knowledge: ```markdown --- description: API documentation with best practices argument-hint: [api-file] --- Document the API in @$1 following our API documentation standards.

references/testing-strategies.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/testing-strategies.md [1/3] Description: # Command Testing Strategies Comprehensive strategies for testing slash commands before deployment and distribution.

Tool: references/testing-strategies.md [2/3] Description: Trying forbidden: !`ls -la /` EOF > /test-forbidden # Verify: Permission denied or appropriate error ``` ### Level 7: Integration Testing **What to test:** - Commands work with other plugin components - Commands interact correctly with each other - State management works across invocations - Workflow commands execute in sequence **Test scenarios:** **Scenario 1: Command + Hook Integration** ```bash # Setup: Command that triggers a hook #

Tool: references/testing-strategies.md [3/3] Description: appearing in /help** ```bash # Check file location ls -la .claude/commands/my-command.md # Check permissions chmod 644 .claude/commands/my-command.md # Check syntax head -n 20 .claude/commands/my-command.md # Restart Claude Code claude --debug ``` **Issue: Arguments not substituting** ```bash # Verify syntax grep '\$1' .claude/commands/my-command.md grep '\$ARGUMENTS' .claude/commands/my-command.md # Test with simple command first echo "T

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
11
Files Flagged
11
Chunks Analyzed
26
Analyzed
Feb 21, 2026, 04:47 PM
Security Audit — runlayer — command-development