The Agent Skills Directory

[PROMPT_INJECTION]: The skill instructions and the run_claude.py script explicitly enable the --dangerously-skip-permissions flag for the Claude CLI by default. This overrides the CLI's built-in safety boundaries and permission prompts, allowing the model to perform operations without user-facing confirmation.
[COMMAND_EXECUTION]: The script executes external commands using subprocess.run. Specifically, the resolve_claude_oauth_token function spawns an interactive login shell (e.g., /bin/zsh -lic) to extract the CLAUDE_CODE_OAUTH_TOKEN environment variable. This execution triggers the loading of shell configuration files which could contain arbitrary code.
[DATA_EXFILTRATION]: The skill accesses and processes sensitive credentials from the environment, including CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_API_KEY, and ANTHROPIC_AUTH_TOKEN. While these are used for authenticating the CLI, the retrieval mechanism involves executing shell environment logic.
[COMMAND_EXECUTION]: The skill includes a fallback mechanism that dynamically executes other local scripts (e.g., codex-runner/scripts/run_codex.py) based on availability, which increases the execution surface of the agent.

claude-runner