claude-code-setup — agentic threat model

Not certain from the listing — likely relies on Anthropic's Claude models. Primary threats include indirect prompt injection where malicious files within a scanned repository manipulate the underlying model to output compromised configuration recommendations.

The agent directly reads local repository data to formulate recommendations. This introduces risks of data exfiltration if the agent is compromised, or repository poisoning where malicious codebase structures trick the parser.

The framework orchestrates codebase analysis to generate hooks, skills, and configurations. Insecure generation of these components could lead to arbitrary code execution if the user blindly applies the suggested configurations.

Not certain from the listing — presumably runs locally within the user's terminal or IDE environment. If unsandboxed, a compromise of the tool could lead to local privilege escalation or unauthorized access to the host filesystem.

Not certain from the listing — there is no mention of built-in guardrails, logging, or evaluation mechanisms to verify the safety of the generated configurations before they are presented to the user.

Not certain from the listing — security controls appear to rely entirely on the user's local operating system permissions and manual review of the generated configuration files.

The agent actively recommends subagents, skills, and MCP servers. This introduces significant ecosystem risks, such as recommending malicious or vulnerable third-party MCP servers, facilitating downstream supply chain attacks.