claude-team

The server's core logic for iTerm2 control and filesystem operations (like git worktrees and settings files) appears well-controlled. It does not use `eval` or other obvious dynamic code execution vulnerabilities within its own Python code. The primary security considerations stem from its intended function: orchestrating AI agents that execute commands in a terminal. The `dangerously_skip_permissions` flag explicitly signals a security tradeoff for agent autonomy. Environment variables like `CLAUDE_TEAM_COMMAND` and `CLAUDE_TEAM_CODEX_COMMAND` allow users to configure alternative CLI tools, which could introduce risks if misconfigured to run malicious binaries. However, these are user-configurable inputs, and the server itself facilitates rather than introduces these command executions directly.