Claude Code Framework
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The package implements an agent execution framework that matches its description (permission checks, context budget, hooks) but claims to be derived from a 'leaked' Claude Code source and exposes powerful hook/extension points you should audit before use.
This skill is internally coherent and implements what it advertises, but review before enabling: 1) provenance/licensing: SKILL.md claims the code comes from a leaked Claude Code release — confirm legal/ethical sourcing before use; 2) hooks: the HookManager allows arbitrary handlers at many lifecycle points (including pre_agent_spawn and pre_send_message) — only register handlers you trust and audit their code/logging behavior; 3) executors: executeTool is unimplemented in the framework and a host will need to wire real executors (which may require credentials) — ensure those executors enforce approval flows for network/git/exec operations; 4) runtime risk: even though the framework doesn't request secrets, it is designed to gate high-risk actions (git push, curl, exec). If you plan to run this in production, audit the included TypeScript, remove or verify any references to external/proprietary sources, and restrict who can register hooks or change rules.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.