claude-code-skill
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is explicitly designed to execute arbitrary shell commands via the 'bash' tool and persistent agent sessions. This is a primary feature described in the documentation for tasks like running tests or refactoring code.
- [EXTERNAL_DOWNLOADS]: The MCP system can be configured to spawn servers using 'npx', which may dynamically download and execute packages from the npm registry at runtime. Examples in the codebase show the use of official Model Context Protocol servers.
- [DATA_EXFILTRATION]: The MCP client implementation ('src/mcp/client.ts') passes the current process environment variables to sub-processes. This is a standard pattern for providing credentials (e.g., GITHUB_TOKEN) to MCP servers, but it represents a potential data exposure risk if an untrusted or malicious MCP server is configured by the user.
- [REMOTE_CODE_EXECUTION]: The skill manages the lifecycle of external MCP servers by spawning sub-processes and communicating with them via stdio. This involves executing external code as part of the tool's core functionality.
- [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection by ingesting untrusted data from the local environment (e.g., file contents read via the 'read' tool or outputs from shell commands) and providing it to the AI agent context.
- Ingestion points: Data enters the context through tool outputs (Bash, Read, Glob, Grep) and user-supplied prompts in 'session-send'.
- Boundary markers: No explicit boundary markers or 'ignore embedded instructions' warnings are implemented in the CLI or library code; safety relies on the underlying agent's guardrails.
- Capability inventory: The skill possesses extensive capabilities, including full shell access, file system modifications (Write/Edit), and network operations via the underlying MCP tools.
- Sanitization: The codebase does not appear to perform sanitization or escaping of external content before it is interpolated into the agent's conversation history.
Audit Metadata