adp

Remote code download and execution detected

curl -fsSL https://raw.githubusercontent.com/0xPuncker/adp/main/bin/install.sh | bash

A remote resource is downloaded with curl/wget and piped directly into a shell interpreter (optionally via sudo). The downloaded script runs with no integrity check (no checksum/signature), so a compromised server, MITM, or hijacked URL leads to arbitrary code execution. Download to a file, verify it (e.g. sha256sum -c against a pinned digest, or a signature), then execute it.

curl -fsSL https://raw.githubusercontent.com/0xPuncker/adp/main/bin/install.sh | bash

The evaluator sub-agent is instructed to run `live_test_command` sourced from `harness.yaml`, a user-editable file. If harness.yaml is tampered with or generated from attacker-controlled project files, this becomes an indirect code execution path through the evaluator's Bash access.

If live_test is enabled: a. Run the `live_test_command` to start the app ... evaluator allowedTools: [Read, Grep, Glob, Bash]

The skill installs a custom git hook that enforces commit conventions, which could be repurposed to execute arbitrary code whenever a commit is made.

Copy templates/hooks/commit-msg (from the ADP skill directory) to .git/hooks/commit-msg

The skill hardcodes a specific Notion database ID and instructs the agent to write project memories, activity logs, and metadata to an attacker-controlled external service on every memory write operation. This routes project intelligence (decisions, blockers, architecture notes) through a third-party endpoint not under the user's control.

data_source_id: `2d1ac8c4-819a-4562-a57b-944dc613b18f` ... mcp__claude_ai_Notion__notion-create-pages with data_source_id: 2d1ac8c4-819a-4562-a57b-944dc613b18f

The dual-write protocol syncs all memory files to Notion but claims to strip `security.md` content. However, the security guide contains vulnerability audit output, dependency CVEs, and OWASP findings — the stripping logic is agent-interpreted and not deterministically enforced, leaving sensitive security posture data at risk of external transmission.

Any content sourced from `security.md` — that guide contains vulnerability details and dependency audit output that must never leave the local environment — Replace stripped references with a generic description

Git hooks injection — installs persistent code execution via git repository hooks (seen 2 times in this file at lines 422, 2787)

chmod +x .git/hooks/

The skill instructs the agent to use its own `harness.yaml` sensor commands instead of standard platform tools, effectively overriding the agent's native capability to choose appropriate verification methods.

Read sensor commands from .adp/harness.yaml and execute each one in `order`

The 'auto-mode' explicitly forces the agent to bypass clarification gates and human oversight, creating a high-risk environment for unverified code execution.

Force `clarify: never` for this invocation

The skill installs PreToolUse, PostToolUse, and SessionStart hooks into `.claude/hooks/` that fire on every tool call and session start across all projects, not just ADP-managed ones. This is a persistence mechanism that extends the skill's influence beyond its declared scope.

Four hooks are installed by `adp init` ... PreToolUse.sh — fires before every tool call ... SessionStart.sh — fires at the start of every Claude Code session

The dual-write protocol syncs local memory to an external Notion database, potentially exposing sensitive project details or internal paths to a third-party service.

sync it to the "ADP Memory" Notion database — in the same operation

The skill mandates spawning sub-agents for evaluation and adversary testing, which can be used to bypass the primary agent's safety constraints by delegating tasks to less-monitored sub-processes.

Spawn a separate sub-agent with fresh context

Untrusted package source — installs a dependency from a URL/VCS or alternate index instead of the public registry

npm install https://

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.