claude-expert

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The document exposes multiple high-risk capabilities—arbitrary shell/tool execution, hook callbacks that can send data externally, auto-approved file edits (subagents/acceptEdits), an auto-loading skills/plugins directory, and remote MCP/agent runtimes and networking modes—which together create clear vectors for data exfiltration, remote code execution/backdoors, credential theft, and supply-chain abuse if untrusted scripts/plugins or misconfigured permissions are used.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via Channels: runtime receives Telegram/Discord/custom webhook messages (user-authored text) and the agent incorporates that message content into the conversation context it sends to the LLM.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The docs show runtime fetch-and-load of remote plugins and MCP servers (e.g. "claude --plugin-url " which downloads a hosted plugin archive at session start, MCP server URLs like "https://my-server.example.com/sse", and runtime commands that invoke remote packages such as npx @playwright/mcp@latest) — these are fetched/loaded during skill runtime and can inject prompts, tools or execute remote code, so they meet the flagging criteria.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the full skill content for literal credentials. I found one high-entropy token-like string that appears to be an actual credential rather than an obvious placeholder:
• Telegram bot token shown in channels-telegram.md: 123456789:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw Reason: This matches Telegram bot-token format (numeric ID + long opaque secret) and is high-entropy; it is presented as the token to copy/store and is not truncated or labeled as a placeholder.

I also noted several other auth-like patterns that I ignored for these reasons:

• sk-ant-api03-... / sk-ant-... examples in ant-cli are truncated with "..." (redacted/truncated) — ignored per rule about truncated/redacted values.
• Generic placeholders like ANTHROPIC_API_KEY=your-key, export ANTHROPIC_API_KEY=your-key, and "YOUR_API_KEY" — documentation placeholders, so ignored.
• Many IDs shown with ellipses (agent_011..., env_01..., session_01...) — truncated examples, ignored.
• No PEM / RSA / private-key blocks or other full API keys without ellipses were found.

Given the presence of the Telegram token string (a high-entropy literal credential that would grant control of a bot), I treat this as an active secret disclosure in the document.