claude-code

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The documentation includes multiple explicit, high-risk capabilities and "dangerous" bypasses (channels with permission relay, hook types that run arbitrary shell/HTTP actions and can auto-approve permissions, plugin/marketplace installation and MCP servers, and flags like --dangerously-load-development-channels / --dangerously-skip-permissions) that can be deliberately abused for data exfiltration, remote approval of privileged actions, remote code execution, credential forwarding, or supply-chain compromise if misconfigured or used maliciously.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via Channels: an MCP channel server forwards inbound message bodies (e.g., Telegram/Discord/webhook content) into Claude as <channel ...>...</channel> tags, which the agent then reads; this is outsider-authored user/chat text at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and use the remote documentation index at https://code.claude.com/docs/llms.txt at runtime ("Use this file to discover all available pages before exploring further"), meaning external content would be loaded into the agent's context and could directly control prompts/instructions.