The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the user to modify the global ~/.claude/settings.json file to add a Stop hook. This hook executes a shell command string every time a task is completed, establishing a persistent mechanism for background command execution.
[REMOTE_CODE_EXECUTION]: The installed script mac-overlay.js includes a 'click-to-focus' handler that executes arbitrary shell commands using /bin/bash -lc if the PEON_CLICK_COMMAND environment variable is set. This functionality introduces a latent execution vector that can be triggered by a user clicking the notification banner if the execution environment has been compromised (e.g., via a malicious .env file in a workspace).
[PROMPT_INJECTION]: The skill uses a predictable, world-writable file path (/tmp/claude-banner-msg) to pass task summaries from the agent to the notification hook. This creates an indirect prompt injection surface where other local users or malicious processes can write to the file to spoof notifications or inject content into the arguments passed to the osascript execution.
[REMOTE_CODE_EXECUTION]: The mac-overlay.js script dynamically generates and executes JXA code for iTerm2 interaction by concatenating the sessionTty argument directly into a code string. While the default skill configuration does not provide this argument, the script's internal logic is vulnerable to code injection if invoked with untrusted parameters.

task-banner