claude-agent-sdk

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The content contains multiple explicit features and examples (eval-based tool, Bash/Python execution tools, automatic "acceptEdits" file edits combined with checkpointing/rewind, environment variable handling, and web/fetch capabilities) that clearly provide straightforward primitives for remote code execution, stealthy file modification (backdoors), credential access, and data exfiltration if misused or configured maliciously.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's documentation explicitly lists built-in WebSearch and Fetch tools that retrieve web pages and web search results (references/tools-reference.md and references/api-reference.md), which the agent can read and act on as part of its workflow, enabling untrusted third-party content to influence decisions and tool use.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The prompt explicitly enables tools that execute shell commands and read/write/edit files (including examples using Bash and acceptEdits), and provides no enforced safeguards—so it directly enables actions that can modify system state (including system files or actions that would require sudo) and therefore poses a high risk.