Claude Dev Setup

• Analyzed: Mar 24, 2026, 10:26 AM
• Findings: 1
• Version: 1.1.0
• Hash: cf52a163c1cdf0953f6c13b05881f7c1dfa3daca93cc81f90bbc7bfd536b560c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill automates the extraction of sensitive OAuth tokens from `~/.claude/.credentials.json` and instructs the agent to use them in shell commands with the `--dangerously-skip-permissions` flag. It also suggests modifying user shell profiles (`~/.bashrc` or `~/.zshrc`) to persist this token extraction logic. While these actions are plausibly required for the stated goal of integrating the Claude Code CLI into an automated agent workflow, the automated handling of raw credentials and the modification of system configuration files represent significant security risks. Key files: `SKILL.md`, `setup.sh`, and `agents-section.md`.