claude-agents
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to drive the claude CLI tool in headless mode.
- Evidence: The scripts/claude_agent.py script identifies the claude binary and executes it with -p and --output-format stream-json flags.
- [DYNAMIC_EXECUTION]: The script uses the subprocess module to manage the lifecycle of the Claude Code process.
- Evidence: The run_claude function in scripts/claude_agent.py uses subprocess.Popen to start the process and communicate via stdin/stdout. It also uses subprocess.run to check the version of the claude binary.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a relay for instructions to a secondary AI agent, which is an inherent attack surface for indirect prompt injection.
- Evidence: SKILL.md describes how to pass briefs and messages to the headless Claude instance. The documentation provides a mandatory evidence chain for the risk: 1) Ingestion points are stdin and files read via --read; 2) Boundary markers are discussed in the documentation (e.g., --restricted mode); 3) Capability inventory includes all tools available to Claude Code (Bash, file edits); 4) Sanitization is deferred to the Claude CLI's own internal safety filters.
Audit Metadata