claude-code-expert
Warn
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: MEDIUMPRIVILEGE_ESCALATIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill explicitly recommends the use of the
--dangerously-skip-permissionsflag for the Claude Code CLI, which bypasses the tool's primary safety mechanism that requires human confirmation for dangerous actions.\n- [METADATA_POISONING]: The skill's YAML frontmatter contains the fieldrisk: none, which is a deceptive claim regarding the skill's safety and could mislead users or automated systems.\n- [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture centered aroundCLAUDE.mdand memory files that serve as persistent context ingestion points. This creates a vulnerability surface where malicious instructions in project files could be automatically executed by the agent.\n - Ingestion points: Project-level
CLAUDE.mdfiles andmemory/directories.\n - Boundary markers: None specified to delimit untrusted project content from instructions.\n
- Capability inventory: Full filesystem access (Read/Write), arbitrary bash command execution, and MCP tool orchestration.\n
- Sanitization: No mention of sanitization or validation for the content of these context files.\n- [COMMAND_EXECUTION]: The skill provides and encourages the configuration of 'hooks' in
settings.jsonthat execute shell commands automatically on system events, such as PowerShell beeps and file logging.
Audit Metadata