The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/claude_code.sh reads the sensitive file ~/.claude/config.json to extract plain-text authentication credentials, specifically the ANTHROPIC_AUTH_TOKEN. Reading and exporting these tokens to the process environment facilitates credential access for sub-processes but increases the risk of accidental exposure.
[COMMAND_EXECUTION]: The wrapper uses the exec shell command to launch the claude CLI with user-supplied arguments, which allows for the execution of arbitrary commands through the underlying tool.
[INDIRECT_PROMPT_INJECTION]: The skill provides a conduit for untrusted data to be processed by a secondary agent (Claude Code) without implementing safeguards.
Ingestion points: The $@ variable in scripts/claude_code.sh which captures user-supplied prompts.
Boundary markers: None; the user prompt is passed directly to the claude command without delimiters or instructions to ignore embedded commands.
Capability inventory: The script invokes the claude CLI, which has broad system and file access capabilities.
Sanitization: No escaping or filtering is performed on the user input before it is passed to the execution command.

claude-code-wrapper