The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/run_claude.py is vulnerable to shell command injection. The user-provided prompt argument is interpolated directly into a shell string that is executed via su -c.\n
Evidence: The line f'cd {temp_workdir} && claude --print "{prompt}" 2>&1' in scripts/run_claude.py allows an attacker to execute arbitrary commands by including shell metacharacters like backticks, semicolons, or $() within the prompt string.\n- [PRIVILEGE_ESCALATION]: The skill performs operations that require elevated privileges, including switching to a different user and recursively changing file ownership.\n
Evidence: The script uses `su
-cto execute commands andshutil.chown` to modify file permissions on the host system. The README explicitly states that root or sudo privileges are a dependency.\n- [DYNAMIC_EXECUTION]: The skill dynamically constructs and executes system commands at runtime based on user input and file system state.\n
Evidence: The run_claude_code function in scripts/run_claude.py assembles command lists and strings for execution through subprocess.Popen.\n- [INDIRECT_PROMPT_INJECTION]: The skill architecture creates a large attack surface by processing untrusted natural language data in a privileged execution environment without sufficient boundaries or sanitization.\n
Ingestion points: The prompt parameter in scripts/run_claude.py receives natural language tasks from the agent or user.\n
Boundary markers: No boundary markers, delimiters, or 'ignore instructions' warnings are used; the prompt is simply double-quoted in a shell command.\n
Capability inventory: The skill can read and write files, sync directory trees, and execute the claude CLI, which itself has broad code-modification capabilities.\n
Sanitization: No sanitization, escaping, or validation of the input prompt is performed before it is passed to the shell.

claude-code-runner