Claude Task Runner

• Analyzed: Mar 29, 2026, 10:41 AM
• Findings: 1
• Version: 1.1.0
• Hash: 93a967c10d2db8ce2d92aa11920627bc76e322ccc54bc196b666ff7885f4de59
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle facilitates headless Claude Code execution using the `bypassPermissions` flag, which allows the agent to execute shell commands and modify files without user intervention. While these capabilities are aligned with the stated purpose of a task runner, they represent high-risk behaviors under the provided criteria. Additionally, the files (SKILL.md and run-task-example.sh) contain hardcoded paths for a specific local user (`/Users/zhengweidong/`) and reference an external model API (`open.bigmodel.cn`), though no explicit evidence of malicious intent or data exfiltration is present.