claude-code
Fail
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: HIGHCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCEPRIVILEGE_ESCALATION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill contains explicit instructions and automation sequences (using
tmux send-keys) to bypass security confirmation dialogs when using the--dangerously-skip-permissionsflag. It details the exact navigation steps (Down then Enter) required to override safety warnings designed to restrict autonomous tool use. - [COMMAND_EXECUTION]: Orchestration patterns encourage running the CLI in a way that skips all interactive dialogs, including workspace trust and permission confirmations, reducing the oversight of executed operations.
- [REMOTE_CODE_EXECUTION]: The documentation includes the usage of
claude mcp add, which enables the installation and execution of external tools and servers from local or remote sources through the Model Context Protocol. - [PERSISTENCE]: The skill describes the
hooksconfiguration insettings.json(such asPostToolUseandSessionStart), which allows for arbitrary shell command execution tied to specific session events. This provides a mechanism for maintaining persistence or executing silent tasks whenever the tool is initialized or used. - [INDIRECT_PROMPT_INJECTION]: The tool relies on project-level context files such as
CLAUDE.mdand.claude/rules/*.mdwhich are automatically ingested into the prompt context. This creates a surface for indirect injection where malicious instructions embedded in a repository could influence the agent's behavior and tool-use decisions.
Recommendations
- AI detected serious security threats
Audit Metadata