claude-code-pro
Fail
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/start.shscript invokes the Claude Code CLI with the--dangerously-skip-permissionsflag by default. This grants the background session the ability to execute shell commands and modify the file system without requiring manual approval for each tool invocation. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of potentially untrusted data through a high-privilege sub-agent.
- Ingestion points: Untrusted data enters the agent context via the
taskprompt and the files contained within the specifiedworkdirrelative toscripts/start.sh. - Boundary markers: No explicit boundary markers or 'ignore' instructions are added by the shell wrappers to the task input; the skill relies on the underlying CLI's safety guardrails.
- Capability inventory: The skill environment provides broad capabilities including full file system read/write and arbitrary shell command execution within the isolated tmux socket.
- Sanitization: Inputs are passed using
tmux load-buffervia temporary files inscripts/start.shandscripts/send.sh, which effectively sanitizes multi-line strings and prevents direct shell command injection during the hand-off to the tmux session.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata