gemini-use-claude-acp
Fail
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/claude-delegate.mjssets the environment variableCLAUDE_CODE_SKIP_PERMISSIONS=1when spawning the sub-agent. This flag bypasses the human-in-the-loop security model of Claude Code, allowing the delegated agent to execute shell commands and file system operations autonomously. - [REMOTE_CODE_EXECUTION]: The skill uses
pnpm dlx @zed-industries/claude-code-acpto download and execute code from the NPM registry at runtime. This execution path is used to handle the primary delegation logic. - [EXTERNAL_DOWNLOADS]: The skill fetches dependencies from the NPM registry via
pnpm installin thescripts/directory and viapnpm dlxfor the ACP adapter. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a proxy that ingests user-provided text and passes it to a powerful sub-agent with tool access.
- Ingestion points: Command line arguments passed to
claude-delegate.mjsare used as the prompt for the sub-agent. - Boundary markers: None. The prompt is interpolated directly into the ACP request.
- Capability inventory: The delegated Claude Code agent possesses tools for shell command execution and filesystem access.
- Sanitization: None. The skill does not filter or validate the prompt before delegation, and the use of
SKIP_PERMISSIONSremoves the final layer of user review for the sub-agent's actions.
Recommendations
- AI detected serious security threats
Audit Metadata