Claude Code Audit: Confirmed RCE via Environment Variable Injection