taste-review
Warn
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The script uses the macOS
security find-generic-passwordcommand to access the system Keychain. It specifically targets an entry labeled "Claude Code skill OAuth" to retrieve a password/token. While used for legitimate authentication of the CLI tool, programmatic access to system credential stores is a sensitive data exposure concern. - [COMMAND_EXECUTION]: The skill executes the
claudeCLI via a bash script (claude -p "$prompt"). This behavior involves spawning subprocesses to handle user-supplied questions and repository file content. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (user questions and file content) and passes it to an external LLM call via the CLI.
- Ingestion points: The shell script template ingests a
<your question>string and<paths>to files within the repository. - Boundary markers: None; the input is interpolated directly into an EOF-delimited string block without specific escaping or ignore-instruction delimiters.
- Capability inventory: The skill can execute the
claudeCLI, access the macOS Keychain, and read local files. - Sanitization: None; the content from local files and the user question are passed directly to the
claudecommand line as a prompt argument.
Audit Metadata