claude-remote-sessions

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The code intentionally exposes powerful remote-control and data-export capabilities (tmux send-keys, skill installs, full-pane snapshot/history uploads to Discord) via guild slash commands without per-user enforcement, enabling remote code execution, data exfiltration, and supply-chain abuse if an attacker or unauthorized guild member can invoke those commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider free text from Discord users is ingested into the agent context via the in-session Discord MCP plugin (--channels plugin:discord@claude-plugins-official) which delivers channel/thread message content to Claude Code at runtime; the skill’s workflow does not sanitize/strip that user-authored text before it reaches the LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill performs a runtime curl to the Discord API (https://discord.com/api/v10/channels/${channel_id}/messages?limit=${limit}) and injects the fetched channel messages into the spawn-thread system prompt (i.e., the fetched content is included in the model's instructions/context), which directly controls agent prompts at runtime.