reference-claude-code

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The document is a benign configuration reference but exposes multiple powerful features that can be intentionally abused as backdoors or exfiltration vectors (command hooks that run shell scripts, apiKeyHelper/otelHeadersHelper shell-exec helpers, dynamic !command`` injection, MCP servers that run commands or forward HTTP requests, HTTP hooks with Authorization/allowedEnvVars, defaults and flags that auto-approve or bypass permission prompts), so while not overt malware itself it presents high risk of deliberate malicious use if a hostile config or skill is introduced.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly describes ingesting external/user-generated content (e.g., adding arbitrary HTTP MCP servers via "claude mcp add --transport http ... https://...", built-in /pr-comments which "gets GitHub PR comments", Dynamic Context Injection using gh pr view --comments, and PreToolUse matchers that include WebFetch/WebSearch), so the agent is expected to read untrusted third-party web/PR content that could influence tool decisions and actions.