Claude Code Agent SDK

• Outcome: Review
• Latest audit: May 28, 2026 · 8:48 AM UTC
• Version: 1.0.1

Overview

This is a documentation-only skill for Claude Code Agent SDK usage; it describes powerful agent settings but does not itself execute code or hide behavior.

Installers should treat this as reference material for a powerful agent SDK. When applying its examples, prefer narrow allowlists, avoid MCP wildcards except on trusted servers, keep Bash and bypassPermissions in isolated environments, protect API tokens, review telemetry exports, and handle session JSONL files as sensitive records.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The documentation explicitly recommends pre-approving tools via `allowedTools` but does not warn that those tools will execute without interactive permission prompts. In the context of agent tooling, this can lead developers to silently grant powerful MCP/custom tools automatic execution, increasing the chance of unintended file access, network calls, or destructive actions if the tool is misconfigured or abused.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly recommends `allowed_tools=["mcp__enterprise__*"]`, which pre-approves every tool exposed by that MCP server. In an agent SDK context, this broad trust boundary is risky because any destructive, data-accessing, or newly added server tool can be invoked without granular review, increasing the chance of unintended external actions or data exposure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly states that log events can include every prompt, API request, API error, and tool result, and it describes exporting those signals to external observability backends. Without a prominent warning about sensitive-data exposure, operators may enable telemetry in production and unintentionally transmit user data, prompts, secrets, or internal outputs off-system.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example shows an external OTLP endpoint and bearer-token authorization header but does not warn that credentials are being injected via environment variables and telemetry is being exported to a remote system. This can lead users to hardcode secrets, leak tokens through process/environment inspection, or send sensitive telemetry to untrusted collectors.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation says the SDK propagates W3C trace context to the CLI subprocess and that the CLI forwards TRACEPARENT to every Bash/PowerShell command. Forwarding tracing metadata into child command environments can expose correlation identifiers to downstream tools, scripts, logs, or third-party processes without operators realizing cross-boundary telemetry is occurring.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The quickstart demonstrates `permission_mode="acceptEdits"` in a minimal example that encourages an agent to review and fix code, but it does not prominently warn that this will automatically modify local files. In documentation intended for quick adoption, users may copy this configuration directly and grant write access before understanding the consequences, increasing the chance of unintended or unsafe code changes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation lists high-risk modes such as `Read, Edit, Bash, Glob, Grep` as 'Fully automated' and `bypassPermissions` as running all allowed tools, but it does not clearly describe the operational and security risks of autonomous command execution or unrestricted tool use. In an SDK quickstart context, this can normalize unsafe configurations and lead developers to deploy agents with excessive privileges.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly states that full session history, including prompts, tool calls, results, and responses, is automatically written to disk, but it does not warn users that this may include secrets, proprietary code, credentials, or personal data. In an agent SDK context, session transcripts are especially sensitive because they often aggregate high-value operational context over time, so silent persistence materially increases the risk of unintended retention, local disclosure, and compliance issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cross-host resume guidance instructs users to copy raw session JSONL files between machines without warning that these files may contain sensitive conversation history, tool outputs, tokens, or internal code/context. Transferring such files across hosts expands the exposure surface and can lead to data leakage if the destination host, transfer channel, or storage permissions are not adequately secured.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation exposes high-risk configuration options such as auto-approved tools and `bypassPermissions` without any safety warning or usage constraints. In an agent SDK, these settings can materially reduce human oversight and make it easier for downstream developers to deploy agents that execute sensitive actions without adequate review.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Documenting arbitrary environment variable support without caution about secrets handling can lead integrators to pass API keys, tokens, and other credentials into agent runtimes without understanding the exposure risks. In this SDK context, agents, tools, subprocesses, logs, or persisted sessions may indirectly access or leak those values if not carefully isolated.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The session-management APIs and persistence-related features are documented without warning that prompts, outputs, metadata, or other conversation artifacts may be stored locally and later retrievable. That omission can cause developers to handle sensitive user or enterprise data unsafely, especially in production agent deployments where transcripts may contain credentials, code, or regulated information.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

The `*` wildcard allows all tools from a server.

⚠️ `permissionMode: "acceptEdits"` does NOT auto-approve MCP tools. Use `allowedTools` wildcards instead of `bypassPermissions`.

## Transport Types

• Confidence: 88% confidence
• Finding: auto-approve

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/migration-guide.md:74

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/modifying-system-prompts.md:12

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/quickstart.md:67