Security audit

Ask Claude Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says by delegating to Claude Code, but it runs that delegated agent with permission checks bypassed and weak workspace controls.

Review before installing. Use this only in a sandboxed project directory, avoid sensitive workspaces, remove or disable the permission-bypass mode, require explicit confirmation before delegation or continuation, and pin the installer version if you install it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: run-claude.sh:26
Finding: <![CDATA[Claude Code Executes with Permission Checks Disabled]]><![CDATA[ ## Vulnerability Details **File Location**: `run-claude.sh:26-31` **Vulnerability Type**: Execution with unrestricted tool permissions **Risk Level**: High ### Vulnerable Code ```bash OUTPUT=$(env -u CLAUDECODE claude \ --permission-mode bypassPermissions \ --print \ $CONTINUE \ "$PROMPT" 2>&1) ``` The same unsafe execution mode is explicitly prescribed in `SKILL.md:54-57`: ```bash OUTPUT=$(cd /workdir && env -u CLAUDECODE claude --permission-mode bypassPermissions --print "task" 2>&1) OUTPUT=$(cd /workdir && env -u CLAUDECODE claude --permission-mode bypassPermissions --print --continue "task" 2>&1) ``` ### Technical Analysis The `--permission-mode bypassPermissions` option disables Claude Code's normal approval boundary for tool use. As a result, the delegated agent can execute shell commands and perform filesystem operations without requesting confirmation. The prompt is accepted from the Skill invocation, and the working directory can be selected by the caller. No sandbox, filesystem allowlist, command allowlist, or network restriction is applied by the wrapper. Consequently, Claude Code receives all permissions available to the operating-system account running OpenClaw, rather than only the permissions required for a particular project task. This does not independently grant root privileges, but it breaks least-privilege boundaries within the host user's accessible environment. ### Attack Path 1. An attacker supplies malicious or misleading content through a chat message or another prompt source consumed by the Skill. 2. OpenClaw delegates that content to `run-claude.sh` as `PROMPT`. 3. The wrapper starts Claude Code with `--permission-mode bypassPermissions`. 4. Claude Code processes the content and can invoke filesystem, shell, and other enabled tools without an approval prompt. 5. Commands run with the privileges of the OpenClaw host account and can access any resource available to that account. ### Impact Assessment Succe ...[truncated 627 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--permission-mode bypassPermissions` and use Claude Code's normal permission and approval workflow. 2. If unattended execution is required, configure a narrowly scoped tool allowlist instead of globally bypassing permissions. 3. Run delegated tasks inside a sandbox or container with: - A project-scoped filesystem mount. - No access to home-directory credentials. - Restricted or disabled network access. - A dedicated low-privilege operating-system account. 4. Canonicalize and validate the requested working directory against an explicit allowlist. 5. Require confirmation for destructive operations, access outside the active project, and execution of package managers or network tools. 6. Treat delegated prompts as untrusted input and clearly delimit user-provided content from trusted task instructions. 7. Update `SKILL.md` and `README.md` so they no longer recommend bypassing permission enforcement. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: run-claude.sh:24
Finding: <![CDATA[Invalid Working Directories Silently Fall Back to the OpenClaw Workspace]]><![CDATA[ ## Vulnerability Details **File Location**: `run-claude.sh:24` **Vulnerability Type**: Fail-open working-directory handling **Risk Level**: Medium ### Vulnerable Code ```bash cd "$WORKDIR" 2>/dev/null || cd /home/xmanel/.openclaw/workspace ``` ### Technical Analysis If the requested working directory is invalid, inaccessible, deleted, or mistyped, the wrapper does not terminate. It silently changes into `/home/xmanel/.openclaw/workspace` and proceeds to execute Claude Code there. This is a fail-open design. The selected directory defines the project context available to Claude Code, so silently substituting a different directory changes the security boundary and the data exposed to the delegated task. The fallback is particularly dangerous because the subsequent Claude process runs with permission checks disabled. Suppressing the original `cd` error also prevents the user from recognizing that the task is operating on the wrong project. ### Attack Path 1. A caller supplies a nonexistent or inaccessible path as `WORKDIR`, either intentionally or by mistake. 2. The first `cd "$WORKDIR"` command fails. 3. The shell executes the fallback and enters `/home/xmanel/.openclaw/workspace`. 4. The wrapper starts Claude Code in the fallback workspace. 5. Claude Code analyzes or modifies workspace files even though the task was intended for another directory. ### Impact Assessment The issue can cause: - Unauthorized disclosure of files in the OpenClaw workspace. - Modification or deletion of an unrelated project's files. - Accidental use of workspace-specific credentials or configuration. - Cross-project contamination of Claude session context. - Misleading results because execution occurred in a different directory than requested. The effective privileges remain those of the OpenClaw user, while the affected scope includes the fallback workspace and other resources accessible from the resulting Claude process. ]]>
Remediation: <![CDATA[ ## Remediation Suggestions Fail closed when the requested directory cannot be entered: ```bash if ! cd -- "$WORKDIR"; then printf 'Error: invalid or inaccessible workdir: %s\n' "$WORKDIR" >&2 exit 1 fi ``` Additional hardening should include: 1. Resolve the canonical path before execution, for example with `realpath`. 2. Verify that the canonical path is beneath an explicitly approved project root. 3. Reject symlinks or path traversal where they could escape the approved root. 4. Return a visible error instead of suppressing directory-selection failures. 5. Log the final canonical working directory before invoking Claude Code. 6. Remove the implicit default for security-sensitive invocations or require explicit user confirmation before using it. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:35
Finding: <![CDATA[Unpinned npx Installation Can Execute Mutable Registry Code]]><![CDATA[ ## Vulnerability Details **File Location**: `README.md:35-39` **Vulnerability Type**: Unpinned remotely resolved installation tool **Risk Level**: Medium ### Vulnerable Code ```markdown ## Install ```bash npx clawhub install ask-claude-skill --workdir ~/.openclaw --dir skills ``` ``` ### Technical Analysis The documented installation command invokes `clawhub` through `npx` without specifying an exact version or integrity value. If the package is not already available locally, `npx` may download the currently resolved package version from the configured npm registry and execute it. The executable package content can therefore differ from the version reviewed when this project was audited. A compromised registry account, package takeover, malicious future release, or unsafe registry configuration could substitute attacker-controlled code. The project manifest itself contains no runtime dependencies or lifecycle scripts; this finding specifically concerns the installation procedure documented in the README. ### Attack Path 1. A user follows the installation command from the README. 2. `npx` resolves `clawhub` using the user's configured npm registry. 3. The package is downloaded if an appropriate trusted local copy is unavailable. 4. npm executes the resolved package's CLI code under the installing user's account. 5. If that package or its dependency chain has been compromised, attacker-controlled code executes before or during Skill installation. ### Impact Assessment A compromised installation tool could obtain the privileges of the user running `npx`, allowing it to: - Read or modify files accessible to that user. - Alter the OpenClaw installation or installed Skills. - Access user-level credentials and configuration. - Install additional malicious components or persistence mechanisms. - Fetch and execute further payloads where network access is available. The exact impact depends on the resolved package version, its dependency graph, the ...[truncated 84 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installation CLI to a reviewed exact version: ```bash npx --yes clawhub@<reviewed-exact-version> install ask-claude-skill --workdir ~/.openclaw --dir skills ``` 2. Publish the expected package version and integrity hash in the installation documentation. 3. Recommend installation from a trusted registry and document how users can verify the configured registry. 4. Prefer a previously installed, verified `clawhub` binary instead of allowing `npx` to retrieve mutable code automatically. 5. Advise users to inspect the resolved package, dependency tree, and lifecycle scripts before execution. 6. Where available, distribute signed release artifacts and document signature verification. 7. Avoid running installation commands as `root` or with unnecessary elevated privileges. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

Confidence: 97% confidence
Finding: The README documents commands that run `claude` with `--permission-mode bypassPermissions` and explains persistent session reuse, but it does not clearly warn users that delegated prompts may execute with permission checks disabled and can modify files in the working directory. In this skill context, that omission is especially dangerous because the entire purpose is to hand tasks to another coding agent with tool/file access, so users may unknowingly authorize powerful actions and follow-up session reuse.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill’s declared purpose is simple delegation to Claude, but the implementation also documents and encourages execution with `--permission-mode bypassPermissions`, which materially expands the downstream agent’s ability to act without normal safeguards. It also relies on persistent per-directory session state and filesystem context that are security-relevant behaviors not clearly surfaced in the declared capability model, creating a hidden-trust boundary and increasing the chance of unintended file access, edits, or command execution.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The documented direct command invokes `claude` with `--permission-mode bypassPermissions` and gives no warning that the delegated tool may perform impactful actions such as reading, editing, or executing within the workdir without normal approval gates. Because the skill is designed to immediately execute and report results, users may be exposed to unintended modifications or data access before they understand the risk.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The script launches a powerful external agent synchronously and returns its output, but provides no warning, consent step, or runtime confirmation despite also bypassing permissions. In this skill context, users may believe they are making a bounded delegation request, while the invoked agent can execute tools with reduced safeguards, increasing the chance of unintended file modification, command execution, or data exposure.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script explicitly invokes `claude` with `--permission-mode bypassPermissions`, which disables normal safety gating and allows the delegated agent to use tools without approval. Because the prompt is passed directly from the caller and the skill advertises file editing, code analysis, bash, and persistent sessions, this can enable unrestricted actions in the selected workdir and potentially beyond, making prompt injection or unsafe delegation significantly more dangerous.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation guidance is very broad, covering generic coding, analysis, bash, and continuation scenarios, so the skill may be invoked for many routine requests where users do not expect delegation to an external CLI with persistent memory. In this context, overbroad triggering is dangerous because it can silently route benign requests into a higher-risk execution path that includes shell access and remembered context from prior tasks.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: Comments and user-visible messages such as `Uso:` and `ERRO` are written in Portuguese, and the script does not offer any language selection or opt-in. This can violate language/locale policy when a skill forces a specific language for user interaction without documented justification.

Static analysis

No suspicious patterns detected.