cc-version-analysis
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from GitHub (release tags and CHANGELOGs) to identify changes in the CC CLI. This creates an entry point for untrusted data into the agent's context. The skill mitigates this through a mandatory Phase 1.5 'Raw Source Verification Gate', which requires cross-referencing quantitative claims against multiple raw sources and performing verbatim spot-checks.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute system commands for environment detection (e.g., 'claude --version'), file system counts, and binary analysis. It also invokes a local Node.js script ('scripts/cc-binary-equivalence.js') to perform technical measurements like SHA256 hashing and Mach-O segment analysis.
- [EXTERNAL_DOWNLOADS]: The workflow fetches release information and changelog files from official Anthropics repositories on GitHub. These operations target well-known, trusted domains related to the software being analyzed.
Audit Metadata