claude-multi-agent

BENIGN. The skill’s capabilities match its purpose as a Claude Code orchestration wrapper, and data flows stay with local files plus the official Anthropic CLI/backend. Main risk is operational: autonomous background runs and optional bypassPermissions can perform significant code and shell actions without per-step approval, but this is disclosed and proportionate to the skill’s purpose rather than covert or exfiltrative.

The code is a transparent background launcher rather than apparent malware. No data exfiltration, credential theft, obfuscation, or destructive behavior is present in the fragment. The main security concerns are the unsafe use of WORKTREE in a filesystem path and the default bypassPermissions mode, which can enable unrestricted actions by the downstream runner. Validate WORKTREE as a basename, use a safe log-directory construction, and require explicit opt-in for bypass permissions.

The snippet itself is not malware; it is an event-driven configuration that enables execution of local shell scripts under `${CLAUDE_PROJECT_DIR}/.claude/hooks/` on multiple lifecycle events. This creates a high-impact command-execution pathway whose actual safety depends entirely on the contents and integrity of the referenced `.sh` hook scripts and whether they can be tampered with. Review and verify the `.claude/hooks/*.sh` files (and repository integrity/permissions) before trusting this configuration.