Claude Code Runner

• Outcome: Review
• Latest audit: Aug 2, 2026 · 10:41 AM UTC
• Version: 1.0.2

Overview

This skill appears to be a broad code-running assistant that can execute commands and write files, but its documentation does not clearly scope or warn about that power.

Review before installing. Use only in repositories or environments where you are comfortable allowing command execution and file writes. Avoid running it with sudo/root privileges unless a specific, user-approved task requires it, and do not rely on the stated safe-sandbox claim without separate containment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documented input/output schema describes a generic content-processing interface rather than a high-risk code runner that can execute commands and modify files. This mismatch can cause users or calling agents to invoke the skill under false assumptions, weakening consent, policy gating, and downstream safety controls around execution.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The skill claims commands run in a 'safe sandbox' while elsewhere stating it uses PTY, executes system commands, and may require root/sudo. This is a dangerous trust mismatch because operators may relax scrutiny or allow broader use based on a nonexistent containment boundary, increasing the chance of host compromise or destructive actions.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The activation language is broad enough to match common development, debugging, and deployment requests, which can cause over-invocation of a powerful execution-capable skill. When a skill can run commands and write files, loose triggering criteria materially raise the risk of unintended execution in contexts where a read-only or lower-privilege tool would have sufficed.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The markdown advertises capabilities and quick-start usage without a clear warning that the skill can execute commands and modify files. Users may invoke it without understanding that it performs high-impact actions, creating risk of accidental destructive changes, privilege misuse, or execution of unsafe prompts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The description includes development and deployment scenarios but does not adequately warn that deployment-related actions may make irreversible system or environment changes. In a skill with exec/write tools and PTY-based operation, omission of this warning increases the chance of accidental service disruption or configuration drift.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 限制条件
* Requires Unix-like environment (uses PTY)
* Requires root/sudo for user switching
* ai-assistant Code must be installed separately
* May not handle all edge cases of interactive prompts

• Confidence: 93% confidence
• Finding: Documenting a requirement for root/sudo for user switching indicates the skill may operate with elevated privileges. In combination with PTY command execution, broad usage language, and weak warnings, this creates a high-risk path to privileged command execution, system modification, or lateral misuse if the skill is triggered on unsafe input.

Static analysis

No suspicious patterns detected.