two-claude-relay

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repo intentionally runs an unattended AI agent (claude) with shell access and git push privileges via --dangerously-skip-permissions and exposes task/report files, creating an effective remote-code-execution/data-exfiltration capability that can be abused or act as a backdoor.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required runtime flow feeds outsider-authored free text into the LLM via scripts/watch.sh → claude -p "check next" where the executor reads NEXT-STEPS.md/COWORK-STATUS.md from the repo (which can originate from other people’s PRs/commits), and those files contain free-form command output and briefs.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs running an agent with "--dangerously-skip-permissions", a cron/launchd poller that runs shell commands (git commit/push, gh pr merge) with unattended push access and no sandboxing, which encourages bypassing permissions and modifying system/repo state automatically.