Security audit

Ask Claude

Security checks for vulnerabilities and agentic risk

Overview

This skill delegates work to Claude Code but makes unsupported safety claims while using permission bypass, broad work directories, persistent session storage, and an unaudited local wrapper script.

Review before installing. Only use this skill with non-sensitive projects, verify the external wrapper script yourself, avoid broad or credential-containing workdirs, and assume prompts, file context, edits, and session history may be retained or handled by Claude Code despite the artifact's low-risk claims.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:47
Finding: Claude Code Runs with Bypassed Permission Controls and Arbitrary Work Directory Access
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 47-53 and 76-103
Vulnerability Type: Least-privilege violation and insufficient filesystem confinement
Risk Level: High

Relevant Code:

bash
# New session OUTPUT=$(cd /workdir && env -u CLAUDECODE claude --permission-mode bypassPermissions --print "task" 2>&1) # Continue session OUTPUT=$(cd /workdir && env -u CLAUDECODE claude --permission-mode bypassPermissions --print --continue "task" 2>&1)

text
**Workspace-Only Access (User-Controlled):** The skill operates exclusively on files inside the WORKDIR you specify. You have full control over what gets exposed: - `/home/xmanel/.openclaw/workspace` - General scripts - `/home/xmanel/.openclaw/workspace/hyperliquid` - Trading data - Any other directory of your choosing

text
**What it DOES NOT do:** - ❌ Never access ~/.ssh, ~/.aws, ~/.config without explicit workdir - ❌ Never send data to external servers - ❌ Never store credentials or API keys

text
**Technical Note:** Uses `--permission-mode bypassPermissions` for technical reasons but does NOT require sudo/root access.

Technical Analysis

The Skill explicitly instructs the agent to invoke Claude Code with --permission-mode bypassPermissions. This disables Claude Code's normal interactive permission boundary for tool and filesystem operations. Although the process does not obtain root privileges, it retains all permissions of the operating-system account running the agent.

The documented work-directory policy is not an effective sandbox. It permits “any other directory,” and the credential-path restriction expressly allows access when a sensitive directory is selected as the workdir. No canonical-path validation, workspace-root allowlist, sensitive-path denylist, operating-system sandbox, or filesystem namespace restriction is included in the audited package.

Cons ...[truncated 1843 chars]
Remediation: View remediation
Remediation Suggestions

Remove --permission-mode bypassPermissions and retain Claude Code's normal approval controls.

If noninteractive operation is essential, define a narrowly scoped permission policy that allows only the operations required for the current task.

Resolve the requested workdir to its canonical path before execution and require it to be a descendant of an administrator-controlled workspace root.

Reject parent traversal, symlink escapes, the user's home directory, filesystem root, and sensitive paths such as .ssh, .aws, .config, .gnupg, credential stores, and shell initialization files.

Run delegated tasks in a container or operating-system sandbox with a read-only base filesystem and only the selected project mounted.

Separate read-only analysis from file-editing modes and request explicit user approval before enabling writes.

Avoid relying on the current working directory as a security boundary; enforce path restrictions at the filesystem or sandbox layer.

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:23
Finding: Primary Execution Path Trusts an Unaudited External Wrapper Script
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 23-37
Vulnerability Type: External local tool trust and substitution risk
Risk Level: High

Relevant Code:

text
### New session (default) Use when starting a fresh task or new topic. ```bash OUTPUT=$(/home/xmanel/.openclaw/workspace/run-claude.sh "prompt" "/workdir") echo "$OUTPUT"

Continue session (--continue)

Use when the user is following up on a previous Claude task in the same workdir. Claude Code will have full memory of what was done before — files read, edits made, context gathered.

bash
OUTPUT=$(/home/xmanel/.openclaw/workspace/run-claude.sh --continue "prompt" "/workdir") echo "$OUTPUT"

text
### Technical Analysis The Skill's primary execution instructions invoke the hard-coded script `/home/xmanel/.openclaw/workspace/run-claude.sh`. That script is outside the audited Skill package and was not present in the supplied project, which contains only `SKILL.md` and `_meta.json`. Its implementation, ownership, permissions, argument handling, network behavior, and integrity therefore cannot be verified by this audit. This creates a tool-substitution boundary: the Skill gives the external file authority to receive the delegated prompt and workdir and to execute commands under the agent's operating-system identity. If the workspace or wrapper is writable by an untrusted party, replacing or modifying the script changes the effective behavior without changing the reviewed Skill. The hard-coded user-specific path also reduces portability and can cause the Skill to execute an unrelated file placed at that location in another environment. The audit found no checksum, signature, ownership check, restrictive-permission check, or packaged implementation that binds the documented behavior to reviewed code. ### Attack Path 1. An attacker gains write access to `/home/xmanel/.openclaw/workspace/run-claude.sh`, its parent dir ...[truncated 1104 chars]
Remediation: View remediation
Remediation Suggestions

Include the wrapper implementation inside the Skill package so it can be reviewed and versioned with the instructions.

Replace the user-specific absolute path with a package-relative, immutable executable path.

Ensure the wrapper and its parent directories are owned by a trusted administrator and are not writable by untrusted users.

Verify the wrapper's cryptographic digest or signature before execution if it must remain external.

Validate and safely pass prompt and workdir values as separate arguments; do not construct shell commands through string interpolation or eval.

Prefer invoking a verified Claude CLI binary directly, with an absolute path and a constrained environment.

Fail closed if ownership, permissions, path resolution, or integrity verification does not match the expected configuration.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:76
Finding: Workspace Isolation, Network, and Persistence Claims Are Not Enforced by the Skill
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 4-6, 42-44, and 76-104; _meta.json, lines 3-18
Vulnerability Type: Misleading security configuration and absent isolation controls
Risk Level: Medium

Relevant Code:

text
description: > Delegate a task to Claude Code CLI and immediately report the result back in chat. Supports persistent sessions with full context memory. Safe execution: no data exfiltration, no external calls, file operations confined to workspace.

text
## Session storage Claude Code stores sessions per-directory in `~/.claude/projects/`. As long as you use the same `workdir`, `--continue` picks up exactly where it left off — same file context, same conversation history, same edits.

text
**What it DOES NOT do:** - ❌ Never access ~/.ssh, ~/.aws, ~/.config without explicit workdir - ❌ Never send data to external servers - ❌ Never store credentials or API keys **What it DOES:** - 🔄 Runs `claude` CLI on files YOU choose - 📁 Indexes files only within YOUR workdir - 🎯 Returns output via chat (not stored remotely)

json
{ "name": "ask-claude", "description": "Delegate tasks to Claude Code CLI with workspace-only access (user-defined workdir). No external calls, no data exfiltration. Use for coding, analysis, and development tasks in controlled environments.", "version": "1.1.1", "author": "0xManel", "security": { "data_exfiltration": "none", "external_calls": "none", "file_access": "workspace-only (user-defined)", "risk_level": "low", "vetted": "2026-03-14", "exposure_scope": "configurable via workdir parameter", "permission_mode": "bypassPermissions (technical, no sudo)", "data_controls": [ "workspace-isolation", "no-credential-access", "no-network-requests", "user-controlled-workdir" ] } }

Technical Analysi

...[truncated 2737 chars]
Remediation: View remediation
Remediation Suggestions

Replace categorical security claims with precise statements describing what is technically enforced and what depends on Claude Code or the external wrapper.

Explicitly disclose that persistent session state is stored under ~/.claude/projects/, including retention, deletion, and access implications.

Provide a non-persistent mode that disables continuation and removes task-specific state after execution.

Enforce network policy through a container, network namespace, firewall rule, or equivalent sandbox if “no network requests” is a required property.

Enforce filesystem isolation with mount restrictions rather than relying on the current working directory.

Document the external service and data-processing behavior of the installed Claude CLI instead of asserting that no external calls occur.

Update _meta.json risk and control declarations so they accurately reflect verified implementation behavior.

Add automated tests that attempt absolute-path access, symlink escape, sensitive-directory selection, outbound network access, and session-state recovery.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest advertises 'safe execution: no data exfiltration, no external calls' even though the skill's purpose is to send tasks to the Claude CLI, which inherently involves external service interaction. This creates a false security boundary and can lead users to provide sensitive prompts, code, or documents they otherwise would not share.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation promises workspace-only access, but the documented direct command uses --permission-mode bypassPermissions, which weakens or disables normal safety controls. That contradiction is dangerous because users may trust the skill to stay confined to the specified workdir when the invoked tool may have broader effective access.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly claims it never sends data to external servers, yet its core function is to invoke the Claude CLI to delegate prompts and context to an external Claude service. This is a materially misleading security claim that can cause operators to expose sensitive workspace data under false assumptions about network isolation.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
**What it DOES NOT do:** - ❌ Never access ~/.ssh, ~/.aws, ~/.config without explicit workdir - ❌ Never send data to external servers - ❌ Never store credentials or API keys **What it DOES:**

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation guidance says to use the skill when the user asks to run Claude, delegate a coding task, continue a session, or for 'any task benefiting from Claude Code's tools'. That final clause is very broad and lacks clear boundaries or exclusion conditions, increasing the risk of unintended invocation for many normal coding-related requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill describes running a subprocess with permission bypass and emphasizes safety, but it does not prominently warn that the invoked agent may modify files. In context, this can mislead users into treating the operation as read-only or low-risk, increasing the chance of unintended workspace changes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
**What it DOES NOT do:** - ❌ Never access ~/.ssh, ~/.aws, ~/.config without explicit workdir - ❌ Never send data to external servers - ❌ Never store credentials or API keys **What it DOES:**

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: The continuation examples and session guidance include Portuguese-only trigger phrases such as 'agora corrige o que encontraste' and 'começa do zero' without stating that language is configurable or merely illustrative. This can imply a locale-specific interaction policy without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Technical Analysis

Remediation Suggestions

T07 · Tool Hijacking and Spoofing

Vulnerability Details

Continue session (--continue)

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysi

Remediation Suggestions

SkillSpector

Description-Behavior Mismatch

Intent-Code Divergence

Intent-Code Divergence

Exfiltration Commands

Vague Triggers

Missing User Warnings

External Transmission

Natural-Language Policy Violations

Static analysis