Versioned security assessment
Report ID: SA-D848445C
7/5/2026, 2:47:20 AM
Command Development security assessment v6
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- Command Development
- Version
- v6
- Maintainer
- anthropics
- Coverage
- 11 Files scanned · 7,237 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
2 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
Most static alerts are documentation snippets, code fences, command paths, URLs, or testing examples rather than install-time execution. I confirmed alerts where the skill intentionally demonstrates executable Claude Code command templates, especially inline Bash and shell substitution with user-supplied arguments. No prompt injection attempt was found in the reviewed files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
11 Files scanned · 7,237 Lines analyzed
155 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 8 evidence locations
Filesystem access
May read or write local files.
Observed in 25 evidence locations
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 347 evidence locations
Capability review items (153)
Medium
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/quality-check.js $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/security-scan.sh $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/perf-analyze.sh $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/best-practices.sh $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/pre-release-check.sh $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build-release.sh $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/run-tests.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/package.sh $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Current git state: !`git rev-parse --short HEAD`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Build info: !`cat package.json | grep -E '(name|version)'`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Run plugin analyzer: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Validate environment argument: !`echo "$1" | grep -E "^(dev|staging|prod)$" && echo "VALID" || echo
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Check build script exists: !`test -x ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh && echo "EXISTS" || echo
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Verify configuration available: !`test -f ${CLAUDE_PLUGIN_ROOT}/config/$1.json && echo "FOUND" || ec
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
**Execute build:** !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh $1 2>&1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
**Validation results:** !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/validate-build.sh $1 2>&1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Determine check level: !`echo "$1" | grep -E "^prod$" && echo "FULL" || echo "BASIC"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
- Full test suite: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/test-full.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Security scan: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/security-scan.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Performance audit: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/perf-check.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Compliance check: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/compliance.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Basic tests: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/test-basic.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Quick lint: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/lint.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/script-name.js $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Validate input: !`echo "$1" | grep -E "^pattern$" && echo "OK" || echo "ERROR"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Check exists: !`test -f ${CLAUDE_PLUGIN_ROOT}/path/file && echo "YES" || echo "NO"`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
!`echo "Plugin root: ${CLAUDE_PLUGIN_ROOT}"`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`ls -la ${CLAUDE_PLUGIN_ROOT}/scripts/`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`ls -la ${CLAUDE_PLUGIN_ROOT}/config/`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`node ./scripts/analyze.js`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
!`bash script.sh` # Will fail without Bash permission
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/script.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Validate: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Test execution: !`npm test $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
**Current Branch:** !`git branch --show-current`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
**Status:** !`git status --short`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
**Recent Commits:** !`git log --oneline -5`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
**Remote Status:** !`git fetch && git status -sb`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
3. Verify cluster accessibility: !`kubectl cluster-info`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`git status`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Context: !`git status`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Current status: !`git status`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Recent commits: !`git log --oneline -5`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`gh pr view $1 --json title,body,author,files`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Files changed: !`gh pr diff $1 --name-only`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Test status: !`gh pr checks $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Current branch: !`git branch --show-current`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Latest commit: !`git log -1 --format=%H`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Running tests: !`npm test`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Branch: !`git branch --show-current`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Status: !`git status --short`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`npm test`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`npm test`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Previous version: !`current-version.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`deploy.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`rollback.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`validate.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`build.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`deploy.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
branch: !`git branch --show-current`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
commit: !`git rev-parse HEAD`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
timestamp: !`date -u +%Y-%m-%dT%H:%M:%SZ`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`deploy.sh [environment]`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Shell command substitution
branch: $(git branch --show-current)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
commit: $(git log -1 --format=%H)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
timestamp: $(date -u +%Y-%m-%dT%H:%M:%SZ)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
Branch: $(git branch --show-current)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
Started: $(date)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Ruby/shell backtick execution
- Git repository: !`git rev-parse --git-dir 2>/dev/null`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Current branch: !`git branch --show-current`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Running tests: !`npm test`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Current version: !`cat version.txt`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`risky-operation.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Shell command substitution
if [ "$1" = "production" ] && [ "$(git branch --show-current)" != "main" ]; then
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
- Verify file exists: ls -la $(dirname "$1")
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Template literal with command substitution
Current branch: !`git branch --show-current`
The snippet combines Claude Code inline Bash syntax with command substitution semantics. It is a documentation example, but copied command files execute local shell commands.
Medium
Ruby/shell backtick execution
Current changes: !`git diff --name-only`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
- Check cluster status: !`kubectl cluster-info`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Deployment details: !`gh api /deployments/$1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
- Current language: !`detect-language.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
- Existing frameworks: !`detect-frameworks.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
- Available tools: !`check-tools.sh`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`pbcopy < file.txt`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Shell command substitution
case "$(uname)" in
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
- Platform: $(uname)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
- Working directory: $(pwd)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
- Git repository: $(git rev-parse --git-dir 2>&1)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
- Write permissions: $(test -w . && echo "OK" || echo "DENIED")
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
- Required files: $(test -f config.yml && echo "Found" || echo "Missing")
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
VERBOSE=$(grep "^verbose:" .claude/plugin-name.local.md | cut -d: -f2 | tr -d ' ')
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
COLOR=$(grep "^color:" .claude/plugin-name.local.md | cut -d: -f2 | tr -d ' ')
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
MAX_RESULTS=$(grep "^max_results:" .claude/plugin-name.local.md | cut -d: -f2 | tr -d ' ')
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
Completed at: $(cat .claude/operation-completed.flag)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
echo "$(date)" > .claude/operation-completed.flag
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
TEMP_DIR=$(mktemp -d)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Ruby/shell backtick execution
Run analysis: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Run analysis: !`node /path/to/plugins/plugin-name/scripts/analyze.js`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Lint results: !`node ${CLAUDE_PLUGIN_ROOT}/bin/lint.js $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Step 1 - Prepare: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/prepare.sh $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Step 3 - Execute: !`${CLAUDE_PLUGIN_ROOT}/bin/execute $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`test -f ${CLAUDE_PLUGIN_ROOT}/config.json && echo "exists" || echo "missing"`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Run: !`${CLAUDE_PLUGIN_ROOT}/bin/process.sh $1 $2`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
2. Current git branch: !`git branch --show-current`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
3. Application version: !`cat package.json | grep version`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Build: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Validate: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/validate.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Test: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/test.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Environment check: !`echo "Deploying to: $1"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`mkdir -p ${CLAUDE_PLUGIN_ROOT}/cache && date > ${CLAUDE_PLUGIN_ROOT}/cache/last-run.txt`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/lint.js $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Validate environment: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Check file: !`test -f $1 && echo "EXISTS" || echo "MISSING"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Validate inputs: !`test -n "$1" -a -n "$2" && echo "OK" || echo "MISSING"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
- Config exists: !`test -f ${CLAUDE_PLUGIN_ROOT}/config.json && echo "✓" || echo "✗"`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Scripts exist: !`test -d ${CLAUDE_PLUGIN_ROOT}/scripts && echo "✓" || echo "✗"`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Tools available: !`test -x ${CLAUDE_PLUGIN_ROOT}/bin/analyze && echo "✓" || echo "✗"`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Build: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Exit code: !`echo $?`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
- Output exists: !`test -d dist && echo "✓" || echo "✗"`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
- File count: !`find dist -type f | wc -l`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Try processing: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/process.js $1 2>&1 || echo "ERROR: $?"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Current date: !`date`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Test output: !`echo "Hello from bash"`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Trying forbidden: !`ls -la /`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`exit 1`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`false`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`command-that-does-not-exist`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`echo ""`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`cat /dev/null`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
!`yes | head -n 1000000`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Shell command substitution
MARKERS=$(head -n 50 "$COMMAND_FILE" | grep -c "^---")
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
FRONTMATTER=$(sed -n '/^---$/,/^---$/p' "$COMMAND_FILE" | sed '1d;$d')
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
MODEL=$(echo "$FRONTMATTER" | grep "^model:" | cut -d: -f2 | tr -d ' ')
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
DESC=$(echo "$FRONTMATTER" | grep "^description:" | cut -d: -f2-)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
cmd_name=$(basename "$cmd_file" .md)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
COMMANDS_CHANGED=$(git diff --cached --name-only | grep "\.claude/commands/.*\.md")
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
> /cmd $(python -c "print('a' * 10000)")
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Shell command substitution
START=$(date +%s%N)
The snippet shows shell command substitution in command or shell examples. It is not executed by the skill itself, but copied use executes local commands and can expose environment or repository state.
Medium
Ruby/shell backtick execution
Files changed: !`git diff --name-only`
The snippet demonstrates Claude Code inline Bash execution. It is context-gathering documentation rather than malicious code, but copied command files will run the external command.
Medium
Ruby/shell backtick execution
Run tests: !`npm test $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
1. Fetch PR: !`gh pr view $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Run analysis: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/script.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Build: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Test: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/test.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Package: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/package.sh`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/lint.js $1`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Validate environment: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
Check file exists: !`test -f $1 && echo "EXISTS" || echo "MISSING"`
The snippet is a Claude Code inline Bash command template and interpolates slash-command arguments into a shell command. It is documentation, but copied commands can execute user-influenced shell input, so the risk is real.
Medium
Ruby/shell backtick execution
- Script: !`test -x ${CLAUDE_PLUGIN_ROOT}/bin/analyze && echo "✓" || echo "✗"`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
- Config: !`test -f ${CLAUDE_PLUGIN_ROOT}/config.json && echo "✓" || echo "✗"`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Medium
Ruby/shell backtick execution
Execute build: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh 2>&1 || echo "BUILD_FAILED"`
The snippet demonstrates executing plugin-local scripts or filesystem checks through Claude Code inline Bash. It is not install-time execution, but copied templates run external plugin code during command invocation.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (2)
RISK-001 High
SKILL.md:457-467references/plugin-features-reference.md:119-121references/plugin-features-reference.md:201examples/plugin-commands.md:68-74
Unsafe Shell Argument Interpolation Guidance
The guidance includes command templates that pass slash-command arguments such as $1 and $2 directly into inline Bash commands. Command authors may copy these patterns and create commands vulnerable to shell injection or option injection.
Multiple examples combine Claude Code inline Bash with positional arguments. The context is educational rather than malicious, so confidence is high but not absolute.
RISK-002 Medium
SKILL.md:619-640references/plugin-features-reference.md:140-160references/marketplace-considerations.md:16-24
Overbroad Bash Permission Examples
Several distributed command examples use allowed-tools: Bash(*) for plugin and cross-platform workflows. This normalizes broad shell access where narrower tool patterns would reduce blast radius.
The cited sections show Bash(*) in reusable command templates. The skill also recommends narrower scopes elsewhere, so this is a guidance quality risk, not clear malicious intent.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighInline Bash examples interpolate slash-command arguments directly.Validate arguments with strict allowlists, quote shell variables, and avoid passing raw $1 or $2 into shell commands.
- FIX-002MediumSome examples use broad Bash(*) permissions.Replace broad Bash permissions with the narrowest command family required, such as Bash(git:*) or Bash(npm:*).
- FIX-003LowExecutable examples are mixed with reference documentation.Label examples as non-executable patterns and include secure variants for every Bash template.
- FIX-004LowLocal, hidden, and temporary path examples can alarm scanners.Clarify that these paths are for testing or Claude Code conventions, and prefer safe temporary test directories.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable