claude-code-runner

SUSPICIOUS. The skill’s capabilities mostly match its stated purpose, but it combines broad local file modification, auto-confirmation of prompts, and elevated privileges with installation from an unverified personal GitHub repo. No clear credential theft or exfiltration is shown, so this is not confirmed malware, but it is a high-trust automation wrapper with meaningful supply-chain and autonomy risk.

The code is an automation wrapper rather than apparent malware, but it contains a high-impact command-injection vulnerability because the user-supplied prompt and path-derived directory are inserted into a shell command without escaping. An attacker controlling the prompt can execute arbitrary commands under the selected user, and the automatic confirmation logic can approve unintended Claude operations. The wrapper also exposes the project and inherited environment to the agent and synchronizes its changes back to the original directory. Use direct subprocess argument execution, strict username validation, shell quoting or no shell, explicit approval handling, environment minimization, and a true global timeout.