Cc Log Viewer

• Outcome: Review
• Latest audit: May 28, 2026 · 11:29 AM UTC
• Version: 1.0.1

Overview

This skill is a real Claude Code log viewer, but it also exposes unauthenticated network control of the Claude session and starts Claude with permission checks disabled.

Install only in a tightly controlled local environment. Do not expose this service to LAN, Tailscale, or the internet unless you add authentication, bind it to localhost or a trusted interface, remove the permission-bypass flag, and separate read-only log viewing from command and restart controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The README advertises a knowledge-graph API that scans an Obsidian vault, which is outside the primary stated purpose of a log viewer/process monitor. Undocumented scope expansion is risky because it may expose local notes, file structure, and metadata to the web service without users realizing the skill accesses unrelated sensitive data.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script explicitly discovers and prints both LAN and Tailscale-reachable URLs for the log viewer, encouraging access beyond localhost. In the context of a real-time Claude Code log viewer with process management and command submission features, this expands the attack surface to other devices on the local or overlay network and can expose sensitive terminal output or control functions if the service lacks strong authentication.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The HTTP /api/send endpoint accepts unauthenticated POST requests and forwards arbitrary attacker-controlled input directly into the Claude terminal session. Because the process is an interactive privileged agent rather than a passive log target, this creates remote command injection and full unauthorized control of the running Claude instance.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Any WebSocket client can connect and send messages beginning with 'cmd:' to inject arbitrary input into the Claude subprocess. Since the server listens on 0.0.0.0 and performs no authentication, this enables remote takeover of the agent session by anyone with network access.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script launches Claude with --dangerously-skip-permissions, deliberately disabling an important safety boundary. In combination with unauthenticated remote input paths, this materially increases the blast radius by allowing injected instructions to run with fewer safeguards than users would expect from a monitoring utility.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states that users can send commands to Claude Code and restart it via HTTP API, which is effectively remote command-and-control functionality. Without prominent warnings and security documentation, users may expose this interface on a network and unintentionally allow unauthorized command execution or service disruption.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Scanning an Obsidian vault can reveal private notes, filenames, links, tags, and workspace structure, yet the README gives no privacy or data-handling warning. In the context of a browser-accessible viewer with WebSocket/HTTP features, this omission increases the chance that sensitive personal knowledge-base data is exposed or transmitted unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description advertises real-time terminal log streaming plus command-sending and process-restart capabilities, but it does not warn that terminal output may contain sensitive data or that exposed control endpoints allow remote interaction with a Claude Code session. In context, this makes the skill materially more dangerous because it is specifically designed for remote observation and control of a live terminal-backed process.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly encourages LAN and remote/mobile access, including use over Tailscale, but omits warnings that anyone with network reachability may be able to view terminal output and potentially interact with the system depending on exposed endpoints. Because the skill is meant to project a live terminal session to other devices, lack of access-control guidance significantly increases the likelihood of unauthorized viewing or control.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documented HTTP API includes `/api/send` to forward arbitrary commands to Claude Code and `/api/restart` to restart the managed process, yet there is no user-facing warning about the integrity and availability consequences if these endpoints are reachable by unauthorized users. In this context, the issue is especially serious because the feature set is not merely passive monitoring; it enables active control of a terminal-connected process, which can lead to arbitrary actions through the agent session, task disruption, and exposure of sensitive workspace data.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The command kills any process currently listening on the selected port without validating ownership or asking for confirmation. A user choosing an occupied port can unintentionally terminate unrelated local services, causing denial of service or disrupting security-sensitive software running on that port.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Starting the subprocess with a permission-bypass flag without explicit warning or confirmation creates a hidden high-risk execution mode. Users may believe they are deploying a passive viewer, while the system actually runs the agent with reduced protections and elevated operational risk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill exposes remote control of the Claude subprocess over HTTP/WebSocket without clear disclosure that the service is not merely observational. This mismatch between stated purpose and actual capability is dangerous because operators may expose the service expecting read-only monitoring while attackers can issue commands instead.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The unauthenticated restart endpoint lets remote clients stop and relaunch the Claude subprocess, enabling denial of service and session disruption. In this context, restart also reinitializes a process started with dangerous settings, compounding operational and security risk.

Static analysis

No suspicious patterns detected.