claude-code-agent-teams
Pass
Audited by Gen Agent Trust Hub on Mar 13, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection where agents are tasked with processing untrusted external content.
- Ingestion points: Agents are instructed to review pull requests and investigate external bug reports (detailed in references/agent-teams-guide.md).
- Boundary markers: There are no explicit instructions for the agents to use delimiters or to ignore embedded instructions within the ingested data.
- Capability inventory: The skill is configured to allow the use of 'Read' and 'Grep' tools across the codebase (SKILL.md).
- Sanitization: The documentation does not specify any sanitization, escaping, or validation of the external content before it is processed by the agent team.
- [PROMPT_INJECTION]: The documentation describes the '--dangerously-skip-permissions' flag, which allows a user to globally disable security prompts for all agents in a team, potentially increasing the risk of unauthorized actions if the lead session is compromised.
- [DATA_EXFILTRATION]: The skill documentation explicitly identifies sensitive storage locations in the user's home directory ('
/.claude/teams/' and '/.claude/tasks/') used for storing configuration and task state, which could be targeted for sensitive data access. - [EXTERNAL_DOWNLOADS]: The guide references and provides installation instructions for the 'it2' CLI from a third-party GitHub repository ('github.com/mkusaka/it2') to enable split-pane display features.
- [COMMAND_EXECUTION]: The skill documentation outlines 'Quality Gates with Hooks' (such as TeammateIdle and TaskCompleted) that execute logic based on process exit codes, which serves as a mechanism for automated script or command execution within the agent's environment.
Audit Metadata