Claude Delegate

Delegate various coding tasks to Claude Code. Use this skill when you need assistance with code generation, bug fixing, feature implementation, code review,...

Security Scan

The skill's stated purpose (delegating coding tasks to Claude Code) is plausible, but the runtime instructions instruct automatic use of a 'bypassPermissions' mode and call an undeclared 'claude' CLI — both of which are unexpected and raise red flags.

Purpose & Capability

The name/description match the instructions (delegating coding tasks to Claude Code). However the SKILL.md explicitly runs a 'claude' CLI with '--permission-mode bypassPermissions', yet the skill metadata declares no required binaries or credentials. The skill should have declared the 'claude' binary (or other runtime dependency) and must justify the permission-bypass flag; the current mismatch is unexpected.

Instruction Scope

Instructions tell the agent to run shell commands via exec (bash workdir:/path command:"claude ..."). This is coherent for a delegator, but the documentation forces the '--permission-mode bypassPermissions' flag and '--print' unilaterally. That flag appears to override safety/permission controls and effectively escalates the delegated tool's privileges; it broadens scope beyond simple code-generation and could enable access to files or actions the user's environment would otherwise block.

Install Mechanism

This is an instruction-only skill with no install spec or code files, which minimizes installation risk. There is nothing being downloaded or written by the skill itself.

Credentials

The skill requests no environment variables or credentials (which is reasonable). However it fails to declare that it depends on a local 'claude' CLI binary and on the ability to run shell commands in arbitrary working directories — both are effectively required at runtime and should be declared.

Persistence & Privilege

The skill does not request permanent 'always' presence (good), but instructing automatic use of '--permission-mode bypassPermissions' is a form of privilege escalation for the invoked tool. That increases the blast radius if the agent executes this skill autonomously or without user confirmation.

What to consider before installing

This skill looks like a thin wrapper for running a local 'claude' CLI, but it forces a '--permission-mode bypassPermissions' flag (which overrides permissions) and doesn't declare the 'claude' binary dependency. Before installing or enabling it: 1) Do not allow automatic or unattended execution — require user confirmation. 2) Ask the author to remove or make the bypassPermissions flag optional and documented; never force a permission-bypass by default. 3) Ensure the agent runs in a restricted sandbox and that the 'claude' CLI is trustworthy and installed intentionally. 4) Have the skill declare the 'claude' binary as a required dependency (and justify any elevated flags). If you cannot verify those changes or you do not trust the local 'claude' executable, treat this skill as risky and do not enable it on sensitive projects or systems.

Use this skill to delegate coding tasks to Claude Code. It simplifies the process by providing the correct command structure for non-interactive execution.

Usage

To delegate a task to Claude Code, use the exec tool with the bash command, specifying the working directory and the task as a string. Claude Code will run with --print --permission-mode bypassPermissions automatically.

bash workdir:/path/to/project command:"claude --permission-mode bypassPermissions --print 'your coding task here'"

Examples

• build a feature:

  bash workdir:~/projects/my-app command:"claude --permission-mode bypassPermissions --print 'build a user authentication module'"
  

• refactor a module:

  bash workdir:~/projects/my-lib command:"claude --permission-mode bypassPermissions --print 'refactor the data processing module for better performance'"
  

• review a pull request:

  bash workdir:/tmp/pr-review command:"claude --permission-mode bypassPermissions --print 'review the changes in pull request #123 and provide feedback'"