Is shareAI-lab/learn-claude-code safe?

No malicious indicators - review capabilities before installing

Notable — review in context (capabilities are not malware):

Python shell/command execution
Possible command injection (shell + dynamic command)
Python filesystem read

What to do: Nothing here argues against installing it. Grant the capabilities it lists only if you expect the tool to need them.

shareAI-lab/learn-claude-code is a directory analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 1 risky construct is reported for review. It can: filesystem read, filesystem write, mcp tools detected and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 20/100 (low).

repo

directory · https://github.com/shareAI-lab/learn-claude-code

LOW

/ 100 risk score

Snapshot · scanned Oct 8, 2026 · repo@ce8f9f1 · engine 0.56.4 / ruleset 62

Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of shareAI-lab/learn-claude-code's authors. Report a false positive.

Capabilities — what this component can do (not a risk score):

filesystem readfilesystem writemcp tools detectedshell execution

Behavioral traits

How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.

Tool surface

Tool Usage

Execution authority

Tool Access Control / Direct Tool Access

Filesystem reach

Tool Execution Context

Findings (7)

HIGHPossible command injection (shell + dynamic command)ST-CMDI-PY

The code builds an OS command out of values that can change at runtime, then runs it through a shell.

agents/s01_agent_loop.py:70-71

r = subprocess.run(command, shell=True, cwd=os.getcwd(),
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s02_tool_use.py:59-61

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace",
                           timeout=120)

agents/s03_todo_write.py:110-111

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s04_subagent.py:64-65

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s05_skill_loading.py:135-136

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s06_context_compact.py:152-153

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s07_task_system.py:142-143

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s08_background_tasks.py:75-78

r = subprocess.run(
                command, shell=True, cwd=WORKDIR,
                capture_output=True, text=True, errors="replace", timeout=300
            )

agents/s08_background_tasks.py:132-133

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s09_agent_teams.py:274-277

r = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

agents/s10_team_protocols.py:315-318

r = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

agents/s11_autonomous_agents.py:401-404

r = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

agents/s12_worktree_task_isolation.py:387-394

r = subprocess.run(
                command,
                shell=True,
                cwd=path,
                capture_output=True,
                text=True, errors="replace",
                timeout=300,
            )

agents/s12_worktree_task_isolation.py:496-503

r = subprocess.run(
            command,
            shell=True,
            cwd=WORKDIR,
            capture_output=True,
            text=True, errors="replace",
            timeout=120,
        )

agents/s_full.py:91-92

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s_full.py:347-348

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                               capture_output=True, text=True, errors="replace", timeout=timeout)

s01_agent_loop/code.py:85-86

r = subprocess.run(command, shell=True, cwd=os.getcwd(),
                           capture_output=True, text=True, errors="replace", timeout=120)

s02_tool_use/code.py:68-70

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace",
                           timeout=120)

s03_permission/code.py:76-77

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

s04_hooks/code.py:64-65

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

s05_todo_write/code.py:67-68

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

s06_subagent/code.py:66-69

result = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

s07_skill_loading/code.py:151-154

result = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

s08_context_compact/code.py:87-90

result = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

s09_memory/code.py:549-556

result = subprocess.run(
            command,
            shell=True,
            cwd=WORKDIR,
            capture_output=True,
            text=True, errors="replace",
            timeout=120,
        )

Why it matters: If any of those values come from untrusted input, an attacker can run their own commands on the machine.

Fix: Pass arguments as a list without shell=True (e.g. subprocess.run(['git', 'checkout', branch])); never build a shell string from external input. If a shell is unavoidable, quote with shlex.quote.

HIGHPython shell/command executionST-SHELL-PY

The component can run operating-system commands or spawn processes.

agents/s01_agent_loop.py:70-71

r = subprocess.run(command, shell=True, cwd=os.getcwd(),
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s02_tool_use.py:59-61

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace",
                           timeout=120)

agents/s03_todo_write.py:110-111

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s04_subagent.py:64-65

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s05_skill_loading.py:135-136

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s06_context_compact.py:152-153

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s07_task_system.py:142-143

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s08_background_tasks.py:75-78

r = subprocess.run(
                command, shell=True, cwd=WORKDIR,
                capture_output=True, text=True, errors="replace", timeout=300
            )

agents/s08_background_tasks.py:132-133

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s09_agent_teams.py:274-277

r = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

agents/s10_team_protocols.py:315-318

r = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

agents/s11_autonomous_agents.py:401-404

r = subprocess.run(
            command, shell=True, cwd=WORKDIR,
            capture_output=True, text=True, errors="replace", timeout=120,
        )

agents/s12_worktree_task_isolation.py:62-68

r = subprocess.run(
            ["git", "rev-parse", "--show-toplevel"],
            cwd=cwd,
            capture_output=True,
            text=True, errors="replace",
            timeout=10,
        )

agents/s12_worktree_task_isolation.py:245-251

r = subprocess.run(
                ["git", "rev-parse", "--is-inside-work-tree"],
                cwd=self.repo_root,
                capture_output=True,
                text=True, errors="replace",
                timeout=10, …

agents/s12_worktree_task_isolation.py:259-265

r = subprocess.run(
            ["git", *args],
            cwd=self.repo_root,
            capture_output=True,
            text=True, errors="replace",
            timeout=120,
        )

agents/s12_worktree_task_isolation.py:364-370

r = subprocess.run(
            ["git", "status", "--short", "--branch"],
            cwd=path,
            capture_output=True,
            text=True, errors="replace",
            timeout=60,
        )

agents/s12_worktree_task_isolation.py:387-394

r = subprocess.run(
                command,
                shell=True,
                cwd=path,
                capture_output=True,
                text=True, errors="replace",
                timeout=300,
            )

agents/s12_worktree_task_isolation.py:496-503

r = subprocess.run(
            command,
            shell=True,
            cwd=WORKDIR,
            capture_output=True,
            text=True, errors="replace",
            timeout=120,
        )

agents/s_full.py:91-92

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

agents/s_full.py:347-348

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                               capture_output=True, text=True, errors="replace", timeout=timeout)

s01_agent_loop/code.py:85-86

r = subprocess.run(command, shell=True, cwd=os.getcwd(),
                           capture_output=True, text=True, errors="replace", timeout=120)

s02_tool_use/code.py:68-70

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace",
                           timeout=120)

s03_permission/code.py:76-77

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

s04_hooks/code.py:64-65

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

s05_todo_write/code.py:67-68

r = subprocess.run(command, shell=True, cwd=WORKDIR,
                           capture_output=True, text=True, errors="replace", timeout=120)

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; avoid shell=True.

MEDIUMNode.js filesystem readST-FS-NODE-READ

The component reads files from disk.

web/scripts/extract-content.ts:199-199

return fs.readFileSync(filePath, "utf-8").replace(/\r\n/g, "\n");

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

MEDIUMNode.js filesystem write/deleteST-FS-NODE-WRITE

The component writes or deletes files on disk.

web/scripts/extract-content.ts:208-208

fs.rmSync(COURSE_ASSETS_DIR, { recursive: true, force: true });

web/scripts/extract-content.ts:469-469

fs.writeFileSync(path.join(OUT_DIR, "versions.json"), JSON.stringify(index, null, 2));

web/scripts/extract-content.ts:470-470

fs.writeFileSync(path.join(OUT_DIR, "docs.json"), JSON.stringify(docs, null, 2));

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

MEDIUMPython filesystem readST-FS-PY-READ

The component reads files from disk.

agents/s02_tool_use.py:70-70

text = safe_path(path).read_text(encoding="utf-8")

agents/s02_tool_use.py:92-92

content = fp.read_text(encoding="utf-8")

agents/s03_todo_write.py:119-119

lines = safe_path(path).read_text(encoding="utf-8").splitlines()

agents/s03_todo_write.py:138-138

content = fp.read_text(encoding="utf-8")

agents/s04_subagent.py:75-75

lines = safe_path(path).read_text(encoding="utf-8").splitlines()

agents/s04_subagent.py:94-94

content = fp.read_text(encoding="utf-8")

agents/s05_skill_loading.py:75-75

text = f.read_text(encoding="utf-8")

agents/s05_skill_loading.py:144-144

lines = safe_path(path).read_text(encoding="utf-8").splitlines()

agents/s05_skill_loading.py:163-163

content = fp.read_text(encoding="utf-8")

agents/s06_context_compact.py:161-161

lines = safe_path(path).read_text(encoding="utf-8").splitlines()

agents/s06_context_compact.py:180-180

content = fp.read_text(encoding="utf-8")

agents/s07_task_system.py:67-67

return json.loads(path.read_text(encoding="utf-8"))

agents/s07_task_system.py:104-104

task = json.loads(f.read_text(encoding="utf-8"))

agents/s07_task_system.py:116-116

tasks.append(json.loads(f.read_text(encoding="utf-8")))

agents/s07_task_system.py:151-151

lines = safe_path(path).read_text(encoding="utf-8").splitlines()

agents/s07_task_system.py:170-170

c = fp.read_text(encoding="utf-8")

agents/s08_background_tasks.py:141-141

lines = safe_path(path).read_text(encoding="utf-8").splitlines()

agents/s08_background_tasks.py:160-160

c = fp.read_text(encoding="utf-8")

agents/s09_agent_teams.py:111-111

for line in inbox_path.read_text(encoding="utf-8").strip().splitlines():

agents/s09_agent_teams.py:141-141

return json.loads(self.config_path.read_text(encoding="utf-8"))

agents/s09_agent_teams.py:286-286

lines = _safe_path(path).read_text(encoding="utf-8").splitlines()

agents/s09_agent_teams.py:307-307

c = fp.read_text(encoding="utf-8")

agents/s10_team_protocols.py:121-121

for line in inbox_path.read_text(encoding="utf-8").strip().splitlines():

agents/s10_team_protocols.py:151-151

return json.loads(self.config_path.read_text(encoding="utf-8"))

agents/s10_team_protocols.py:327-327

lines = _safe_path(path).read_text(encoding="utf-8").splitlines()

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

MEDIUMPython filesystem write/deleteST-FS-PY-WRITE

The component writes or deletes files on disk.

agents/s02_tool_use.py:83-83

fp.write_text(content, encoding="utf-8")

agents/s02_tool_use.py:95-95

fp.write_text(content.replace(old_text, new_text, 1), encoding="utf-8")

agents/s03_todo_write.py:130-130

fp.write_text(content, encoding="utf-8")

agents/s03_todo_write.py:141-141

fp.write_text(content.replace(old_text, new_text, 1), encoding="utf-8")

agents/s04_subagent.py:86-86

fp.write_text(content, encoding="utf-8")

agents/s04_subagent.py:97-97

fp.write_text(content.replace(old_text, new_text, 1), encoding="utf-8")

agents/s05_skill_loading.py:155-155

fp.write_text(content, encoding="utf-8")

agents/s05_skill_loading.py:166-166

fp.write_text(content.replace(old_text, new_text, 1), encoding="utf-8")

agents/s06_context_compact.py:113-113

with open(transcript_path, "w", encoding="utf-8") as f:

agents/s06_context_compact.py:172-172

fp.write_text(content, encoding="utf-8")

agents/s06_context_compact.py:183-183

fp.write_text(content.replace(old_text, new_text, 1), encoding="utf-8")

agents/s07_task_system.py:71-71

path.write_text(json.dumps(task, indent=2, ensure_ascii=False), encoding="utf-8")

agents/s07_task_system.py:162-162

fp.write_text(content, encoding="utf-8")

agents/s07_task_system.py:173-173

fp.write_text(c.replace(old_text, new_text, 1), encoding="utf-8")

agents/s08_background_tasks.py:152-152

fp.write_text(content, encoding="utf-8")

agents/s08_background_tasks.py:163-163

fp.write_text(c.replace(old_text, new_text, 1), encoding="utf-8")

agents/s09_agent_teams.py:102-102

with open(inbox_path, "a", encoding="utf-8") as f:

agents/s09_agent_teams.py:115-115

inbox_path.write_text("", encoding="utf-8")

agents/s09_agent_teams.py:145-145

self.config_path.write_text(json.dumps(self.config, indent=2), encoding="utf-8")

agents/s09_agent_teams.py:298-298

fp.write_text(content, encoding="utf-8")

agents/s09_agent_teams.py:310-310

fp.write_text(c.replace(old_text, new_text, 1), encoding="utf-8")

agents/s10_team_protocols.py:112-112

with open(inbox_path, "a", encoding="utf-8") as f:

agents/s10_team_protocols.py:125-125

inbox_path.write_text("", encoding="utf-8")

agents/s10_team_protocols.py:155-155

self.config_path.write_text(json.dumps(self.config, indent=2), encoding="utf-8")

agents/s10_team_protocols.py:339-339

fp.write_text(content, encoding="utf-8")

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

LOWMCP tool surface detectedST-MCP-DETECTED

An MCP tool surface (manifest or tool definitions) was found.

skills/mcp-builder/SKILL.md:44-44

@server.tool()

skills/mcp-builder/SKILL.md:53-53

@server.tool()

skills/mcp-builder/SKILL.md:104-104

const server = new Server({

skills/mcp-builder/SKILL.md:135-135

const transport = new StdioServerTransport();

skills/mcp-builder/SKILL.md:149-149

@server.tool()

skills/mcp-builder/SKILL.md:169-169

@server.tool()

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.

How attackers abuse these capabilities

Interactive labs on the attack class behind the rules above. They show the technique, not anything found in shareAI-lab/learn-claude-code.

RCE via Tool Arguments lab

Check your own component

Run the same evidence-backed scan on any MCP server, agent skill, or package.

Scan your own component

How we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →