Security audit
Security checks for vulnerabilities and agentic risk
The skill is a plausible Claude Code runner, but it grants command and file-changing power and mentions sudo without clear safety boundaries.
Install only if you intentionally want an agent to run a Claude Code-style tool against your repositories. Use a sandbox or low-privilege account, avoid sudo, review commands and diffs before applying changes, and do not run it on repositories containing secrets unless you understand what may be sent to the external LLM/API service.
The skill advertises execution-oriented capabilities but does not place a clear, prominent warning near the top that it can run commands, read/write files, and operate on a working directory. Because the tool list includes exec and write, omission of an explicit consent warning materially increases the risk of surprising side effects and unsafe use on sensitive repositories or hosts.
The description broadly says to use the skill for code generation, programming assistance, debugging, testing, and deployment, which makes it eligible for many generic developer requests. In a skill with exec/write capabilities, broad activation language raises the risk of accidental invocation in contexts where the user did not explicitly consent to code execution or file changes.
The documented inputs list generic fields like content/mode/style, but all examples use run_claude_code(workdir, prompt) to execute programming tasks. This mismatch can cause an agent or user to invoke the skill with the wrong interface, increasing the chance of unintended command execution, file modification, or unsafe fallback behavior when the runtime tries to infer missing parameters.
The response schema describes a generic content-generation result rather than the outcome of a code runner that may execute commands, modify files, or return execution artifacts. This can mislead downstream agents into treating execution results as harmless text, obscuring whether code ran, what files changed, whether commands failed, and whether sensitive output was produced.
The documentation instructs users to configure an API key and references external LLM/API use, but it does not prominently warn that source code, prompts, logs, or secrets from the working directory may be transmitted to external services. In a code-runner skill, that omission can lead to unintentional exfiltration of proprietary or sensitive data.
The skill explicitly states it may require root/sudo for user switching, which is dangerous in combination with PTY-based command execution. If invoked in an automated agent context, elevated privileges can magnify any prompt mistake, malicious repository instruction, or command injection into full-system compromise or unauthorized file access.
## 限制条件
* Requires Unix-like environment (uses PTY)
* Requires root/sudo for user switching
* ai-assistant Code must be installed separately
* May not handle all edge cases of interactive prompts
The skill name, summaries, and instructions are primarily written in Chinese with embedded English fragments, but there is no statement that users may choose their preferred language. For a general-purpose skill, this can create an implicit locale constraint without user opt-in.
No suspicious patterns detected.