The provided documentation shows two concrete high-risk security patterns: (1) ability to include Authorization credentials in telemetry headers (sent to external OTLP endpoints) and (2) a CLI-based ClaudeCode agent that can disable permission checks and persist raw stdout/stderr. Evidence for actual credential theft/exfiltration or malware behavior is insufficient; risks are therefore based on documented capability/flow, not demonstrated misuse.
Documents running a local Claude Code CLI and provides an example using --permission-mode bypassPermissions, weakening permission/safety controls.; Documents WithRawOutputHook to observe stdout/stderr and recommends writing raw output to log/storage artifacts, increasing potential exposure/persistence of sensitive output.
Documents WithA2ARequestOptions with client.WithRequestHeader("Authorization", ...) to send Authorization headers on per-request calls to remote A2A services.
Documents OTEL_EXPORTER_OTLP_HEADERS="Authorization=Basic ${AUTH_STRING}" for exporting traces to OTLP endpoints; credentials may be transmitted to monitoring systems.
(https://github.com/trpc-group/trpc-agent-go/blob/main/examples/skillrun/skills/python_math/SKILL.md)
npx skillscat add trpc-group/trpc-agent-go/docs-mkdocs-en
Install via the SkillsCat registry.