claude-code-cli
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill leverages local system utilities such as git for diff generation, tmux for handling interactive sessions, and the claude CLI for code analysis.
- [EXTERNAL_DOWNLOADS]: It provides instructions to download the official @anthropic-ai/claude-code package from the NPM registry, which is a well-known and trusted service.
- [DATA_EXFILTRATION]: By design, the skill transmits repository diffs and selected file contents to Anthropic's AI models for review. It incorporates safety prompts and manual review steps to mitigate the risk of accidental secret or credential disclosure.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes untrusted content from code repositories and relays it to an external AI model.
- Ingestion points: Git diffs, staged changes, and untracked files are read in scripts/claude-review-changes.sh and scripts/claude-ask.sh.
- Boundary markers: The skill uses markdown section headers and labels (e.g., '## Change Context') to separate repository data from instructions, though these are not adversarial-resistant.
- Capability inventory: The skill utilizes the claude CLI and terminal commands, with a strong emphasis on maintaining a read-only state using the --permission-mode plan flag.
- Sanitization: Implements automatic truncation of diffs (default 200,000 bytes) and context files (first 240 lines) to manage payload size.
Audit Metadata