claude-headless
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill describes how to run the
claudeCLI for delegated tasks. It explicitly mitigates command injection risks by advising users to pipe long prompts through stdin rather than using shell interpolation.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for task delegation, which naturally involves processing external instructions and repository data.\n - Ingestion points: User-supplied tasks and repository content provided to the
claudecommand (SKILL.md).\n - Boundary markers: The skill recommends a structured prompt template in
references/delegation-and-review.mdto define ownership and scope.\n - Capability inventory: The delegated
claudeCLI tool can modify files and execute commands as part of its standard functionality.\n - Sanitization: The skill advises on shell-level protection (avoiding interpolation) but does not implement content-based filtering of the delegated prompts.\n- [SAFE]: The skill demonstrates proactive security measures, including guidelines to keep credentials out of logs, using private directories for process artifacts, and recommending strict configuration modes to restrict access to external tools (MCP servers).
Audit Metadata