Security audit

Ask Claude Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says by delegating to Claude Code, but it runs that delegated agent with permission checks bypassed and weak workspace controls.

Review before installing. Use this only in a sandboxed project directory, avoid sensitive workspaces, remove or disable the permission-bypass mode, require explicit confirmation before delegation or continuation, and pin the installer version if you install it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: run-claude.sh:26
Finding: <![CDATA[Claude Code Executes with Permission Checks Disabled]]>
Content: View full analysis
&1) ``` The same unsafe execution mode is explicitly prescribed in `SKILL.md:54-57`: ```bash OUTPUT=$(cd /workdir && env -u CLAUDECODE claude --permission-mode bypassPermissions --print "task" 2>&1) OUTPUT=$(cd /workdir && env -u CLAUDECODE claude --permission-mode bypassPermissions --print --continue "task" 2>&1) ``` ### Technical Analysis The `--permission-mode bypassPermissions` option disables Claude Code's normal approval boundary for tool use. As a result, the delegated agent can execute shell commands and perform filesystem operations without requesting confirmation. The prompt is accepted from the Skill invocation, and the working directory can be selected by the caller. No sandbox, filesystem allowlist, command allowlist, or network restriction is applied by the wrapper. Consequently, Claude Code receives all permissions available to the operating-system account running OpenClaw, rather than only the permissions required for a particular project task. This does not independently grant root privileges, but it breaks least-privilege boundaries within the host user's accessible environment. ### Attack Path 1. An attacker supplies malicious or misleading content through a chat message or another prompt source consumed by the Skill. 2. OpenClaw delegates that content to `run-claude.sh` as `PROMPT`. 3. The wrapper starts Claude Code with `--permission-mode bypassPermissions`. 4. Claude Code processes the content and can invoke filesystem, shell, and other enabled tools without an approval prompt. 5. Commands run with the privileges of the OpenClaw host account and can access any resource available to that account. ### Impact Assessment Succe ...[truncated 627 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: run-claude.sh:24
Finding: <![CDATA[Invalid Working Directories Silently Fall Back to the OpenClaw Workspace]]>
Content: View full analysis
/dev/null || cd /home/xmanel/.openclaw/workspace ``` ### Technical Analysis If the requested working directory is invalid, inaccessible, deleted, or mistyped, the wrapper does not terminate. It silently changes into `/home/xmanel/.openclaw/workspace` and proceeds to execute Claude Code there. This is a fail-open design. The selected directory defines the project context available to Claude Code, so silently substituting a different directory changes the security boundary and the data exposed to the delegated task. The fallback is particularly dangerous because the subsequent Claude process runs with permission checks disabled. Suppressing the original `cd` error also prevents the user from recognizing that the task is operating on the wrong project. ### Attack Path 1. A caller supplies a nonexistent or inaccessible path as `WORKDIR`, either intentionally or by mistake. 2. The first `cd "$WORKDIR"` command fails. 3. The shell executes the fallback and enters `/home/xmanel/.openclaw/workspace`. 4. The wrapper starts Claude Code in the fallback workspace. 5. Claude Code analyzes or modifies workspace files even though the task was intended for another directory. ### Impact Assessment The issue can cause: - Unauthorized disclosure of files in the OpenClaw workspace. - Modification or deletion of an unrelated project's files. - Accidental use of workspace-specific credentials or configuration. - Cross-project contamination of Claude session context. - Misleading results because execution occurred in a different directory than requested. The effective privileges remain those of the OpenClaw user, while the affected scope includes the fallback workspace and other resources accessible from the resulting Claude process. ]]>
Remediation: View remediation
&2 exit 1 fi ``` Additional hardening should include: 1. Resolve the canonical path before execution, for example with `realpath`. 2. Verify that the canonical path is beneath an explicitly approved project root. 3. Reject symlinks or path traversal where they could escape the approved root. 4. Return a visible error instead of suppressing directory-selection failures. 5. Log the final canonical working directory before invoking Claude Code. 6. Remove the implicit default for security-sensitive invocations or require explicit user confirmation before using it. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:35
Finding: <![CDATA[Unpinned npx Installation Can Execute Mutable Registry Code]]>
Content: View full analysis
Remediation: View remediation
install ask-claude-skill --workdir ~/.openclaw --dir skills ``` 2. Publish the expected package version and integrity hash in the installation documentation. 3. Recommend installation from a trusted registry and document how users can verify the configured registry. 4. Prefer a previously installed, verified `clawhub` binary instead of allowing `npx` to retrieve mutable code automatically. 5. Advise users to inspect the resolved package, dependency tree, and lifecycle scripts before execution. 6. Where available, distribute signed release artifacts and document signature verification. 7. Avoid running installation commands as `root` or with unnecessary elevated privileges. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README documents commands that run claude with --permission-mode bypassPermissions and explains persistent session reuse, but it does not clearly warn users that delegated prompts may execute with permission checks disabled and can modify files in the working directory. In this skill context, that omission is especially dangerous because the entire purpose is to hand tasks to another coding agent with tool/file access, so users may unknowingly authorize powerful actions and follow-up session reuse.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill’s declared purpose is simple delegation to Claude, but the implementation also documents and encourages execution with --permission-mode bypassPermissions, which materially expands the downstream agent’s ability to act without normal safeguards. It also relies on persistent per-directory session state and filesystem context that are security-relevant behaviors not clearly surfaced in the declared capability model, creating a hidden-trust boundary and increasing the chance of unintended file access, edits, or command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documented direct command invokes claude with --permission-mode bypassPermissions and gives no warning that the delegated tool may perform impactful actions such as reading, editing, or executing within the workdir without normal approval gates. Because the skill is designed to immediately execute and report results, users may be exposed to unintended modifications or data access before they understand the risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script launches a powerful external agent synchronously and returns its output, but provides no warning, consent step, or runtime confirmation despite also bypassing permissions. In this skill context, users may believe they are making a bounded delegation request, while the invoked agent can execute tools with reduced safeguards, increasing the chance of unintended file modification, command execution, or data exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script explicitly invokes claude with --permission-mode bypassPermissions, which disables normal safety gating and allows the delegated agent to use tools without approval. Because the prompt is passed directly from the caller and the skill advertises file editing, code analysis, bash, and persistent sessions, this can enable unrestricted actions in the selected workdir and potentially beyond, making prompt injection or unsafe delegation significantly more dangerous.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is very broad, covering generic coding, analysis, bash, and continuation scenarios, so the skill may be invoked for many routine requests where users do not expect delegation to an external CLI with persistent memory. In this context, overbroad triggering is dangerous because it can silently route benign requests into a higher-risk execution path that includes shell access and remembered context from prior tasks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Comments and user-visible messages such as Uso: and ERRO are written in Portuguese, and the script does not offer any language selection or opt-in. This can violate language/locale policy when a skill forces a specific language for user interaction without documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.