plan
Fail
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The framework makes frequent use of
subprocess.run,subprocess.Popen, andos.systemacross its Python logic and shell scripts (e.g.,_cli/cli/dependencies.py,_templates/hooks/workflow_hooks.py, and_scripts/hooks/subagent_stop.py) to manage git repositories, track state, and execute tests. - [EXTERNAL_DOWNLOADS]: The system dynamically installs Python dependencies (
typer,rich,pydantic,PyYAML) and system-level packages using multiple package managers includingpip,brew,apt-get,dnf,yum, andapkduring runtime to resolve missing components. - [COMMAND_EXECUTION]: The installation utility
_shared/tools/dependency-utils.shcontains commands that invokesudo apt-getto install system packages, constituting a privilege escalation attempt to modify the host environment. - [REMOTE_CODE_EXECUTION]: The framework implements a hook system configured via
~/.claude/settings.jsonthat triggers the automatic execution of local scripts (likeworkflow_hooks.py) on specific tool events, enabling complex automated behaviors across the agent's session. - [DATA_EXFILTRATION]: The skill combines
Read,Bash, andWebFetchcapabilities, which allows for a tool-chaining pattern where local filesystem data can be read, processed, and potentially transmitted to external network endpoints.
Recommendations
- AI detected serious security threats
Audit Metadata