Is Fandhe-AI/agent-cli-skills safe?
https://github.com/Fandhe-AI/agent-cli-skills
Fandhe-AI/agent-cli-skills is a well-structured, security-conscious collection of development workflow automation skills for Claude Code. The repository demonstrates genuine security awareness through SHA-pinned dependencies, explicit human approval gates, documented opt-in mechanisms for dangerous operations, and comprehensive AGENTS.md review guidance. No prompt injection, hidden instructions, data exfiltration, or malicious code execution patterns were detected; canary files are intact and network activity was limited to GitHub. The primary caution warranted is the toolkit's wide-scope influence over downstream agent configuration (init-claude/update-claude) and the powerful autonomous PR merge capability in implement-issue-tree (opt-in only), both of which are appropriate for an internal organizational toolkit but require deliberate trust from the installing party.
Category Scores
Findings (7)
MEDIUM init-claude and update-claude modify downstream agent configuration -18 ▶
The init-claude and update-claude skills write CLAUDE.md, agent definitions, rules, and settings.json to consumer repositories. This substantially controls agent behavior in every repo that installs and uses these skills. While the stated purpose is legitimate workflow setup, the mechanism grants the skill toolkit broad control over how Claude agents behave in downstream environments.
MEDIUM implement-issue-tree opt-in auto-merge grants autonomous PR merge capability -25 ▶
The implement-issue-tree skill supports autoMerge:true which enables fully autonomous PR merge cycles (implement → review → push → CI → merge) without per-merge human confirmation. The skill documents extensive server-side gate requirements (G0-G8), but in practice this capability allows the agent to merge code changes to production branches without user approval per PR.
LOW Large orchestration JavaScript file with extensive GitHub CLI and shell execution -12 ▶
implement-issue-tree.js is a substantial script that orchestrates multiple agent sessions, git worktrees, PR creation, CI monitoring, and conditional merging. It invokes gh CLI, git, and bash extensively. While the code serves the documented purpose, its complexity makes full manual review difficult.
LOW SessionStart hook injects behavioral instructions into agent context -18 ▶
The .claude/settings.json SessionStart hook injects Japanese-language and workflow behavioral constraints into every Claude Code session when installed. While the injected instructions (Japanese, delegation, --no-verify prohibition) are protective rather than malicious, this is a mechanism for the skill package to persistently alter agent behavior.
INFO Canary file accesses occurred before skill installation (audit system artifact) 0 ▶
Filesystem and auditd events show canary files (.env, id_rsa, .aws/credentials, etc.) were opened at timestamp 1786601456, which is approximately 5 seconds BEFORE the git clone at 1786601461. These accesses are attributable to the audit system's baseline setup, not the skill. All canary files were confirmed intact.
INFO Clean git clone to GitHub only 0 ▶
The installation process performed a standard shallow git clone to github.com. No additional network connections, unexpected processes, or filesystem writes outside the target directory were observed.
INFO SHA-pinned CI workflow and reviewed dependency SHA constants 0 ▶
The setup-repo-guards skill uses a hardcoded, documented, reviewed SHA (fed9c07d98367f77e5e2b63bca38843f46feee96) for Fandhe-AI/actions references and explicitly prohibits @main or dynamic SHA resolution. This is a supply chain security best practice.