Codecast

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:26 PM UTC
• Version: 4.1.0

Overview

Codecast does stream coding-agent sessions to Discord, but it also encourages broad permission bypass and includes under-scoped remote control paths that can expose sensitive work or affect local processes.

Install only after reviewing the scripts and using a private, trusted Discord destination. Avoid global permission bypass, do not run PR review or parallel task mode on untrusted input until eval usage is fixed, disable the bridge unless channel and user allowlists are mandatory, and assume streamed sessions may reveal secrets, source code, paths, and command output.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/review-pr.sh:69

Finding

Arbitrary Shell Command Injection Through Pull Request Metadata and Review Prompts

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac RELAY_ARGS=(-w "$WORKDIR" -t "$TIMEOUT" -n "$AGENT Review") [ "$THREAD_MODE" = true ] && RELAY_ARGS+=(--thread) [ "$SKIP_READS" = true ] && RELAY_ARGS+=(--skip-reads) [ -n "$RATE_LIMIT" ] && RELAY_ARGS+=(-r "$RATE_LIMIT") bash "$SCRIPT_DIR/dev-relay.sh" "${RELAY_ARGS[@]}" -- "${AGENT_CMD[@]}" ``` ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/parallel-tasks.sh:59

Finding

Arbitrary Shell Command Injection Through Parallel Task Files

Content

View full analysis

&2 continue } TASK_DIR="${TASK_DIR/#\~/$HOME}" TASK_DIRS+=("$TASK_DIR") TASK_PROMPTS+=("$TASK_PROMPT") TASK_NAMES+=("$(basename "$TASK_DIR")") TASK_COUNT=$((TASK_COUNT + 1)) done < "$TASKS_FILE" COMPLETION_MSG="When completely finished, run: openclaw system event --text 'Done: ${TASK_NAME} - task complete' --mode now" case "$AGENT" in claude*) AGENT_CMD="claude -p --dangerously-skip-permissions --output-format stream-json --verbose '${TASK_PROMPT}. ${COMPLETION_MSG}'" ;; codex*) AGENT_CMD="codex exec --json --full-auto '${TASK_PROMPT}. ${COMPLETION_MSG}'" ;; *) AGENT_CMD="${AGENT} '${TASK_PROMPT}'" ;; esac RELAY_FLAGS="-w $WORK_DIR -t $TIMEOUT -n '${AGENT} [$TASK_NAME]'" RELAY_FLAGS="$RELAY_FLAGS --thread" [ "$SKIP_READS" = true ] && RELAY_FLAGS="$RELAY_FLAGS --skip-reads" [ -n "$RATE_LIMIT" ] && RELAY_FLAGS="$RELAY_FLAGS -r $RATE_LIMIT" eval "bash '$SCRIPT_DIR/dev-relay.sh' $RELAY_FLAGS -- $AGENT_CMD" & ``` ### Technical Analysis Each task prompt is read from a user-selected file and interpolated into a command string. The string is subsequently executed using `eval`. A malicious prompt containing a single quote and shell operators can escape the intended argument and introduce arbitrary shell commands. The task directory, task name, agent option, timeout, and rate-limit values also participate in strings later reparsed by `eval`, creating additional injec ...[truncated 763 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/discord-bridge.py:67

Finding

Discord Bridge Allows Process Control Without Mandatory Channel or User Authorization

Content

View full analysis

`") return ok, msg = kill_session(parts[1]) reply(channel_id, f"{'✅' if ok else '❌'} {msg}") return if not CHANNEL_ID: print("⚠️ Warning: No BRIDGE_CHANNEL_ID set — listening on all channels", file=sys.stderr) print(f" Allowed users: {', '.join(ALLOWED_USERS) if ALLOWED_USERS else 'all'}", flush=True) ``` ### Technical Analysis Both access-control settings are optional and fail open. An empty channel configuration accepts messages from every channel visible to the bot, while an empty user allowlist accepts every non-bot user. The `!kill` handler passes an arbitrary numeric PID directly to `os.kill`. Unlike log and input operations, `kill_session` does not verify that the PID appears in the active Codecast session registry. Consequently, any authorized Discord message sender—or any visible user under default confi ...[truncated 1032 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/parse-stream.py:202

Finding

Sensitive Source Code, Command Output, and Reasoning Are Transmitted Without Redaction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/dev-relay.sh:140

Finding

Unrestricted Webhook URL Can Redirect Session Data to Arbitrary Endpoints

Content

View full analysis

/dev/null | tr -d '\n') [ -z "$WEBHOOK_URL" ] && { echo "❌ Error: .webhook-url not found in $SCRIPT_DIR" >&2 echo " Create it: echo 'https://discord.com/api/webhooks/ID/TOKEN' > $SCRIPT_DIR/.webhook-url" >&2 exit 1 } if ! curl -s -o /dev/null -w "%{http_code}" "$WEBHOOK_URL" 2>/dev/null | grep -q "^200$"; then echo "❌ Error: Webhook URL appears invalid or unreachable" >&2 echo " Check: $SCRIPT_DIR/.webhook-url" >&2 exit 1 fi post() { local msg="$1" name="${2:-$AGENT_NAME}" [ ${#msg} -gt 1950 ] && msg="${msg:0:1900}…*(truncated)*" local jmsg jname jmsg=$(python3 -c "import json,sys;print(json.dumps(sys.stdin.read()))" <<< "$msg") jname=$(python3 -c "import json;print(json.dumps('$name'))") curl -s -X POST "$WEBHOOK_URL" \ -H "Content-Type: application/json" \ -d "{\"content\":${jmsg},\"username\":${jname}}" -o /dev/null 2>/dev/null || true } ``` The platform adapter also trusts the destination directly: ```python webhook_url = os.environ.get("WEBHOOK_URL", "") subprocess.run( ["curl", "-s", "-X", "POST", url, "-H", "Content-Type: application/json", "-d", json.dumps(payload)], capture_output=True, timeout=10, text=True ) ``` ### Technical Analysis The validation verifies only that the configured URL returns HTTP 200. It does not require HTTPS, verify that the hostname is an approved Discord domain, validate the webhook path, or reject local and private-network addresses. If the configuration file or environment can be modified, all streamed development content can be redirected to an attacker-controlled endpoint. The initial GET and subsequent POST requests can also target internal ...[truncated 756 chars]

Remediation

View remediation

/` path. - Reject embedded credentials, IP literals, localhost, link-local addresses, and private-network destinations. - Disable redirects with `curl --max-redirs 0`. - Use certificate verification explicitly and fail closed on TLS errors. - Protect `.webhook-url` with mode `0600`, verify ownership, and reject symbolic links. - Prefer a trusted configuration store and show the normalized destination before the first transmission. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/setup.md:29

Finding

Skill Requires Global Coding-Agent Permission Bypass

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/dev-relay.sh:217

Finding

Codecast Session Metadata Is Stored Insecurely in a Shared Temporary Directory

Content

View full analysis

"$SESSION_FILE" <

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: references/advanced-modes.md:81

Finding

Discord Bridge Dependency Is Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (65)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

PR review automation involving gh CLI access, repository checkout, review prompt generation, and potential comment posting introduces source-code access and write actions against external systems. Those capabilities go well beyond Discord streaming and could expose private repository data or perform unintended actions if users are not explicitly warned.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

PR review automation involving gh CLI access, repository checkout, review prompt generation, and potential comment posting introduces source-code access and write actions against external systems. Those capabilities go well beyond Discord streaming and could expose private repository data or perform unintended actions if users are not explicitly warned.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

PR review automation involving gh CLI access, repository checkout, review prompt generation, and potential comment posting introduces source-code access and write actions against external systems. Those capabilities go well beyond Discord streaming and could expose private repository data or perform unintended actions if users are not explicitly warned.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

PR review automation involving gh CLI access, repository checkout, review prompt generation, and potential comment posting introduces source-code access and write actions against external systems. Those capabilities go well beyond Discord streaming and could expose private repository data or perform unintended actions if users are not explicitly warned.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

PR review automation involving gh CLI access, repository checkout, review prompt generation, and potential comment posting introduces source-code access and write actions against external systems. Those capabilities go well beyond Discord streaming and could expose private repository data or perform unintended actions if users are not explicitly warned.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

PR review automation involving gh CLI access, repository checkout, review prompt generation, and potential comment posting introduces source-code access and write actions against external systems. Those capabilities go well beyond Discord streaming and could expose private repository data or perform unintended actions if users are not explicitly warned.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description promotes observability and zero token burn but does not prominently warn that agent session content is transmitted to Discord via webhook, potentially including commands, file paths, outputs, and other sensitive development data. In a security context, undisclosed external transmission is a serious data-leakage risk because users may invoke the skill without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Discord bridge turns a one-way session streaming tool into a bidirectional remote-control channel by forwarding Discord messages to agent stdin and exposing process-management commands. This materially changes the risk profile: anyone with access to the Discord channel or bot workflow may be able to influence agent behavior, trigger sensitive actions, or manipulate active development sessions remotely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Exposing a !kill <PID> command through Discord allows remote termination of local processes, which can be abused for denial of service, interruption of reviews, or disruption of unrelated work if process targeting is weak. This is especially risky in a tool whose stated purpose is session visibility, because remote process control is a separate privileged capability with destructive effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The setup directs users to globally disable Claude Code's permission safeguards by setting bypassPermissions with allow:["*"], which removes approval gates for all actions, not just Discord streaming. This creates a broad privilege expansion that could let any future prompt, tool invocation, or compromised workflow perform sensitive operations without user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation tells users to disable permission prompts but provides no warning that this weakens a core security control across all Claude Code activity. Users may apply the setting believing it is required for streaming, unaware that it enables unattended execution of sensitive actions far beyond the skill's stated purpose.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 93% confidence

Finding

Directing users to create or modify ~/.claude/settings.json changes the agent's global configuration in its home directory, affecting behavior outside this skill. In this case, the modification is especially dangerous because it weakens approval controls for all future agent sessions, not just codecast usage.

Content

Scanner excerpt · references/setup.md (reported line 31)May include surrounding context.

3. Skip the permissions prompt (Claude Code only)

Create ~/.claude/settings.json if it doesn't exist:

json

{
  "permissions": {

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/dev-relay.sh (reported line 23)May include surrounding context.

sh

#   --parallel <f>  Parallel tasks mode: run tasks from file across worktrees
#
# For Claude Code: uses -p --output-format stream-json --verbose for clean JSON output
# Prerequisites: ~/.claude/settings.json with defaultMode: "bypassPermissions"

set -uo pipefail

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The script accesses sensitive credentials from the macOS Keychain to obtain a Discord bot token. Although this may support legitimate thread creation, credential retrieval increases the blast radius because the script now handles reusable secrets that may grant broader Discord access than a single webhook URL.

Content

Scanner excerpt · scripts/dev-relay.sh (reported line 160)May include surrounding context.

sh

fi

# Bot token (optional, needed for --thread mode in text channels)
# Priority: CODECAST_BOT_TOKEN env var > macOS Keychain > .bot-token file
BOT_TOKEN="${CODECAST_BOT_TOKEN:-}"
if [ -z "$BOT_TOKEN" ] && command -v security &>/dev/null; then
  BOT_TOKEN=$(security find-generic-password -s discord-bot-token -a codecast -w 2>/dev/null || true)

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 92% confidence

Finding

In raw-output mode, the script captures arbitrary agent terminal output and forwards it with only partial ANSI stripping. Untrusted output can still include mentions, deceptive formatting, URLs, embedded secrets, or control-like content that causes downstream abuse in Discord, and the relay lacks robust sanitization or content filtering.

Content

Scanner excerpt · scripts/dev-relay.sh (reported line 252)May include surrounding context.

sh

done
  wait "$RELAY_PID" 2>/dev/null
else
  # Non-Claude agents: use raw output relay with ANSI stripping
  script -q "$OUTPUT_FILE" "$CMD_FILE" &
  AGENT_PID=$!
  echo "$AGENT_PID" > "$RELAY_DIR/agent.pid"

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill is described as a streaming/visibility tool, but this file implements a bidirectional control bridge from Discord into local agent sessions. That creates a remote command-and-control path for coding agents, allowing anyone with channel access and bot reachability to influence local development actions beyond passive observability.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/discord-bridge.py (reported line 13)May include surrounding context.

python

python3 discord-bridge.py [--channel CHANNEL_ID] [--users USER_ID,...] [--verbose]

Environment:
    CODECAST_BOT_TOKEN   Discord bot token (or macOS Keychain: discord-bot-token/codecast)
    BRIDGE_CHANNEL_ID    Discord channel ID to watch
    BRIDGE_ALLOWED_USERS Comma-separated Discord user IDs (empty = all users)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/discord-bridge.py (reported line 48)May include surrounding context.

python

python3 discord-bridge.py [--channel CHANNEL_ID] [--users USER_ID,...] [--verbose]

Environment:
    CODECAST_BOT_TOKEN   Discord bot token (or macOS Keychain: discord-bot-token/codecast)
    BRIDGE_CHANNEL_ID    Discord channel ID to watch
    BRIDGE_ALLOWED_USERS Comma-separated Discord user IDs (empty = all users)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/discord-bridge.py (reported line 426)May include surrounding context.

python

python3 discord-bridge.py [--channel CHANNEL_ID] [--users USER_ID,...] [--verbose]

Environment:
    CODECAST_BOT_TOKEN   Discord bot token (or macOS Keychain: discord-bot-token/codecast)
    BRIDGE_CHANNEL_ID    Discord channel ID to watch
    BRIDGE_ALLOWED_USERS Comma-separated Discord user IDs (empty = all users)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/discord-bridge.py (reported line 44)May include surrounding context.

python

def get_bot_token():
    """Get bot token from env, keychain, or file."""
    token = os.environ.get("CODECAST_BOT_TOKEN", "")
    if token:
        return token

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code forwards Discord content directly into agent stdin via a named pipe or /proc/<pid>/fd/0, enabling remote prompt injection and indirect command execution through the agent. In the context of coding agents that can edit files and run shell commands, this effectively gives remote parties operational influence over the local environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The !kill command allows Discord messages to terminate local sessions, which exceeds the stated purpose of relaying output. This gives remote users an immediate denial-of-service primitive against active agent processes, and if channel/user scoping is misconfigured the effect can be triggered broadly.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Using claude with --dangerously-skip-permissions disables approval safeguards and allows the agent to act without interactive permission checks. Because the same script also feeds arbitrary task prompts and can target working directories containing valuable code, this materially increases the chance of destructive file changes, unintended command execution, or broader compromise from prompt mistakes or malicious instructions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file header and implementation show that this utility is designed to forward agent output, command output, file previews, and summaries to an external chat platform in plain language. In a coding-agent context, these streams frequently contain highly sensitive workspace data, making the skill inherently risky if used without strict disclosure, minimization, and redaction controls.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The helper functions are used to prepare and truncate file-content previews before posting, which confirms that content exposure is intentional and normalized rather than accidental. Truncation reduces size but does not reduce sensitivity; the first or last lines of files often contain credentials, headers, internal endpoints, or personally sensitive data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.