claude-agent-sdk
Warn
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation and examples demonstrate several patterns for dynamic execution. Examples in references/api-reference.md, examples/mcp_calculator.py, and references/custom-tools.md use the Python eval() function to process mathematical expressions from user input. While some examples suggest sandboxing or provide warnings, the use of eval() on untrusted input is a significant risk surface. Additionally, the documentation for custom slash commands in references/slash-commands.md features the !command syntax, which enables the execution of shell commands (such as git status and git diff) at load time to provide context for the agent.
Audit Metadata