delegate-to-claude-code
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
claude-rc-spawn) to orchestrate local commands includingtmux,git, and theclaudeCLI. It generates a temporarylaunch.shscript to manage the session, employingprintf %qfor all shell arguments to prevent command injection into the generated script. - [DATA_EXFILTRATION]: The orchestration script specifically unsets
CLAUDE_CODE_OAUTH_TOKENandANTHROPIC_API_KEYby default when launching sessions. This is a security feature designed to prevent local authentication tokens from being exposed to or interfering with browser-based Remote Control authentication. - [INDIRECT_PROMPT_INJECTION]: This skill facilitates delegation to a subagent, creating a surface for indirect prompt injection if input data is untrusted.
- Ingestion points: The skill reads prompt content from files in the
.agent-runs/directory or from standard input. - Boundary markers: No specific boundary markers are added by the script; it passes the raw prompt content directly to the
claudeCLI. - Capability inventory: The subagent (Claude Code) has broad capabilities including file system access and shell command execution.
- Sanitization: No sanitization is performed on the prompt text; the documentation provides best practices for users to write clear and constrained briefs for the subagent.
Audit Metadata