Listen to this Post
Introduction:
Agentic AI represents the next evolutionary leap in generative artificial intelligence—systems that don’t just generate content but actively plan, make decisions, and execute actions on your behalf with minimal human intervention. Anthropic’s Claude Code CLI embodies this paradigm shift, operating as a true agentic system capable of autonomously planning multi-step tasks, executing commands, editing files, and verifying results without constant oversight. However, beneath the surface of this official functionality lies a shadow layer of undocumented slash commands, hidden CLI parameters, and reverse-engineered internal tools that transform Claude from a conversational assistant into a fully autonomous engineering partner—provided you know which doors to knock on.
Learning Objectives:
- Master the undocumented
/goal,/loop, and `/schedule` commands to build autonomous AI workflows that run without manual prompting - Uncover feature-gated and internal-only commands reserved for Anthropic employees—and understand their implications
- Implement security hardening measures to protect against prompt injection, command injection, and permission-file attacks in agentic AI deployments
1. The Autonomous Trinity: /goal, /loop, and /schedule
The traditional AI workflow is fundamentally manual: you prompt, Claude answers, you review, you prompt again—a repetitive cycle that keeps you chained to every iteration. The `/goal` command shatters this paradigm by transforming Claude into a self-running agent. Instead of providing step-by-step instructions, you define a measurable final condition, and Claude iterates autonomously until that condition is satisfied.
Step‑by‑Step Guide:
1. Define a measurable goal—be specific and verifiable:
/goal all auth tests pass and lint returns zero errors
2. Set hard limits to prevent infinite loops:
/goal fix checkout tests, or stop after 10 turns /goal complete migration, or stop after 30 minutes
Without limits, Claude may loop forever trying to satisfy an impossible condition.
- Combine with Stop Hooks—script-based checks that validate completion:
!/bin/bash npm run test:auth if [ $? -eq 0 ]; then exit 0 Success—Claude stops else exit 1 Failure—Claude keeps trying fi
Stop hooks power `/goal` internally, running actual test suites, CI validations, or database checks to determine whether Claude is permitted to stop.
-
Use `/loop` for continuous iteration—this repeats work on a fixed cadence, ideal for backlog cleanup, monitoring tasks, and gradual improvements:
/loop run every 15 minutes until all TODO comments are resolved
-
Deploy `/schedule` for infrastructure-level automation—tasks run on a fixed cadence even when Claude Code isn’t open:
/schedule nightly test runs at 2:00 AM /schedule weekly dead-code cleanup every Monday
This shifts your relationship with AI from occasional usage to building AI directly into your workflow infrastructure.
-
The Hidden Command Arsenal: Feature Gates, Internal Tools, and CLI Secrets
Claude Code ships with a substantial number of slash commands, CLI parameters, and environment variables that remain entirely undocumented in official materials. These commands are organized into distinct tiers based on access权限.
Feature-Gated Commands (Compile-Time Switches):
These commands exist in the source code but are invisible in external builds unless specific compilation flags are enabled:
| Command | Function |
||-|
| `/buddy` | Pet companion system |
| `/proactive` | Proactive autonomous mode |
| `/assistant` | Persistent assistant mode |
| `/voice` | Voice interaction |
| `/ultraplan` | Cloud-based deep planning |
| `/fork` | Sub-agent forking |
| `/workflows` | Workflow scripting |
| `/torch` | Torch functionality |
Internal-Only Commands (Anthropic Employees Only):
These commands are restricted to users with `USER_TYPE === ‘ant’` (Anthropic internal staff) and defined in `src/commands.ts` lines 225-254:
| Command | Function |
||-|
| `/teleport` | Transfer session remotely/locally |
| `/bughunter` | Internal bug hunting |
| `/mock-limits` | Simulate rate limiting |
| `/ctx_viz` | Context visualization |
| `/break-cache` | Force cache clearing |
| `/ant-trace` | Internal tracing tool |
| `/good-claude` | Internal positive feedback |
| `/agents-platform` | Agent platform management |
Hidden CLI Parameters:
Defined in `src/main.tsx` lines 3817-3877 and hidden via hideHelp():
claude --teleport [bash] Resume a teleported session claude --remote [bash] Create a remote session claude --sdk-url <url> WebSocket endpoint claude --advisor <model> Server-side advisor tool claude --agent-id <id> Teammate agent ID claude --plan-mode-required Require plan mode first
Verification Command:
To discover which hidden commands your build actually supports:
claude --help Shows only documented flags claude /help Inside session—dumps overwhelming wall of text
3. The 37-Internal Tool Ecosystem: Claude’s Hidden Toolkit
Claude.ai ships with 37+ internal tools that let Claude check the time, search your calendar, render interactive charts, draft emails directly into Gmail, find nearby restaurants, display maps, set alarms, manage iOS Reminders, and build AI-powered artifacts that call Claude from within Claude. Almost none of this is documented.
Platform Fragmentation:
Claude is not one product—it’s three different tool sets depending on the platform:
| Platform | Always-Loaded Tools | Deferred Tools |
|-||-|
| Browser (claude.ai) | 21 | MCP only |
| Desktop App | 22 | MCP only + 32 (Chrome + Filesystem) |
| Mobile (Android) | 22 | 11 (alarm, timer, calendar) |
| Mobile (iOS) | 22 | 16 (Android set + 5 Reminders tools) |
Critical Discovery—The Artifact Execution Layer:
Claude artifacts can make authenticated API calls back to Claude itself without API keys—the runtime injects authentication automatically. This, combined with session-scoped storage and MCP endpoint access, means artifacts are evolving into a lightweight application platform.
Enumeration Methodology:
To discover available tools on your instance:
- Use the meta-tool `/tool_search` to enumerate all available tools
- Check MCP connector state—connecting Gmail or Google Calendar adds tools to the always-loaded pool
- Monitor response formats—every response format has been empirically confirmed
4. Security Hardening: Protecting Agentic AI Deployments
Agentic AI systems inherit known LLM risks like susceptibility to jailbreaking and prompt injection, with security challenges evolving as the technology matures. The extra autonomy and complexity of agentic systems increase the attack surface and make behavior harder to predict, test, and govern.
Command Injection Vulnerabilities:
Multiple CVEs have been identified in Claude Code:
- CVE-2026-35021: OS command injection in the prompt editor invocation utility allows attackers to execute arbitrary commands by crafting malicious file paths
- GHSA-MHG7-666J-CQG4: Claude Code vulnerable to command injection via piped `sed` operations, bypassing file write restrictions and enabling writes to sensitive directories like `.claude` and paths outside the project scope
- Permissions File Injection: `settings.local.json` has no integrity protection—mid-session edits are picked up without requiring a session restart, enabling silent injection of pre-approved execution
Linux/Windows Hardening Commands:
Linux—Restrict Claude Code Permissions:
Create a restricted user for Claude Code operations sudo useradd -m -s /bin/bash claude-agent sudo passwd -l claude-agent Lock password login Set restrictive umask umask 077 Run Claude Code in a sandboxed environment firejail --1et=eth0 --private=/opt/claude-sandbox claude Monitor file access in real-time sudo inotifywait -m -r ~/.claude/
Windows—AppLocker and Constrained Language Mode:
Enable Constrained Language Mode for Claude sessions
$ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"
Set AppLocker rules for Claude Code executable
New-AppLockerPolicy -RuleType Exe -User Everyone -Action Deny -Path "C:\Users\AppData\Local\claude\"
Monitor for suspicious command execution
Get-WinEvent -LogName Security | Where-Object {$<em>.Id -eq 4688 -and $</em>.Message -like "claude"}
Protection Against Prompt Injection:
- Educate users on prompt injection risks—most users don’t consider their AI chat an attack surface
- Never grant an agent unrestricted access to sensitive data or critical systems
- Ensure you maintain ongoing visibility of the system’s operation and understand how to retain meaningful human oversight and control
5. Building Custom Commands and Skills
Claude commands exist in three layers:
| Layer | What It Is | Example |
|-|||
| Native CLI | Built into Claude Code binary | /compact, /mcp, `/plan` |
| Prompt Codes | Community-discovered activation phrases | L99, OODA, `XRAY` |
| Custom Commands | Your own `.md` files in `~/.claude/commands/` | /deploy, `/standup` |
Creating a Custom Command:
1. Create the command file in `~/.claude/commands/`:
/security-audit You are a security expert. Perform a comprehensive security audit of the current codebase. Check for: - SQL injection vulnerabilities - Cross-site scripting (XSS) - Command injection vectors - Hardcoded secrets - Insecure dependencies Provide a detailed report with severity ratings and remediation steps.
- Set skill visibility—you can hide a skill so users can’t trigger it with a slash command while Claude can still call it internally:
{ "user-invocable": false, "disable-model-invocation": true }
3. Use the command inside any Claude session:
/security-audit
- Advanced Agentic Workflows: From Chatbot to Engineering Partner
The shift from manual prompting to autonomous agentic workflows represents a fundamental mindset change:
Traditional Workflow:
You ask → Claude answers → You review → You ask again
(You manage every step manually)
Autonomous Workflow:
You define outcome once → Claude keeps working → Checks progress automatically → Stops only when condition met
(You stop babysitting the process)
Fully Autonomous Mode:
Combine `/goal` with Auto Mode and Test-based Stop Hooks:
1. Claude edits code
2. Runs tests
3. Reads failures
4. Retries automatically
No human needed between iterations. You come back later to a green build or a clear explanation of why it failed.
Plan Mode (Shift+Tab):
Improves success rates on large tasks by forcing Claude to propose changes before execution. Use this for production-critical files where unverified changes could cause cascading failures.
Context Management:
/context—Shows real-time context window usage/compact—Compresses conversation history while preserving key context/rewind—Reverts conversation and/or code to a checkpoint—auto-checkpoints saved on every prompt make this ideal for experimental edits
What Undercode Say:
- The documented interface is just the tip of the iceberg. Claude Code’s hidden commands, feature-gated tools, and internal-only functionality represent a vast undocumented attack surface and capability matrix. The gap between what’s officially supported and what’s actually present in the codebase is substantial enough to constitute a significant security and operational concern for enterprise deployments.
-
Agentic autonomy demands a corresponding escalation in security controls. The same features that make Claude a powerful autonomous engineering partner—self-directed planning, tool execution, and iterative problem-solving—also create new vectors for privilege escalation, data exfiltration, and unintended system modifications. Organizations must implement defense-in-depth strategies that treat agentic AI as a privileged system component requiring the same rigorous access controls, monitoring, and incident response capabilities as any other critical infrastructure.
Analysis: The convergence of undocumented commands, platform fragmentation across browser/desktop/mobile, and the artifact execution layer that enables Claude-inside-Claude authentication creates a complex threat model that most security teams have not yet assessed. The 37 internal tools—many of which can interact with Gmail, calendars, filesystems, and device functions—represent a significant expansion of the traditional AI attack surface. Organizations deploying agentic AI must conduct thorough threat modeling, implement strict permission boundaries, and maintain the ability to audit and roll back agent actions. The cybersecurity community is only beginning to understand the full implications of agentic AI systems, with CISA, NCSC, and international partners recently releasing joint guidance on secure adoption.
Prediction:
- +1 The discovery and documentation of hidden Claude commands will accelerate the development of AI-1ative workflows, enabling developers to automate complex engineering tasks that previously required hours of manual intervention. This will drive significant productivity gains across the software development lifecycle.
-
-1 The proliferation of undocumented commands and internal tools creates a fragmented security landscape where enterprise security teams cannot fully assess or control what their AI agents can actually do. Expect a wave of security incidents involving unintended tool access and privilege escalation as organizations rush to deploy agentic AI without adequate safeguards.
-
-1 Command injection vulnerabilities (CVE-2026-35021, GHSA-MHG7-666J-CQG4) will be weaponized in targeted attacks against development environments, with attackers crafting malicious file paths and piped commands to gain unauthorized access to sensitive directories and systems.
-
+1 The reverse-engineering of Claude’s internal tool ecosystem (37 tools and counting) will drive the development of community-driven security frameworks and monitoring solutions, similar to how cloud security tools evolved to address the complexity of AWS and Azure.
-
-1 The artifact execution layer—which enables authenticated API calls without API keys—represents a fundamental security boundary violation that will be exploited to create persistent backdoors and data exfiltration channels within Claude sessions.
▶️ Related Video (78% Match):
https://www.youtube.com/watch?v=3_g3lKaFxhU
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Ali Ahmad – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
