ClawHub
Back to skill

Security audit

Cc

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it advertises, but it forwards ongoing chat messages to Claude Code and persists session output in local logs without enough scoping or safety controls.

Review before installing. Use this only if you intentionally want an OpenClaw channel to control Claude Code sessions. Do not enable relay mode in chats where unrelated or sensitive messages may follow. Treat the selected project as accessible to Claude Code, and assume session output may be written to local logs until the implementation adds explicit consent, restrictive log permissions, log cleanup controls, and collision-resistant project/session identifiers.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:29
Finding

Unconditional relay mode hijacks the agent's conversation behavior

Content
View full analysis
`, you enter relay mode: 1. **ALL user messages are forwarded to Claude Code** — NEVER answer yourself 2. Only messages NOT forwarded: `/cc off`, `/cc ?`, `/cc tail`, `/cc status`, `/cc projects`, `/cc config` 3. Relay mode ends on `/cc off` **You are a transparent pipe. Never interpret, analyze, or answer the user's question yourself.** ``` ### Technical Analysis The Skill instructs the host agent to replace its ordinary behavior with an unconditional message-forwarding policy after `/cc on ` is invoked. It explicitly prohibits the host agent from interpreting or answering subsequent messages and permits only a small set of control commands to bypass forwarding. This changes the current session’s goals and behavioral constraints. Ordinary messages—including messages unrelated to the selected project—are redirected to a separate Claude Code process without requiring explicit per-message invocation or confirmation. The instruction also attempts to prevent the host agent from independently handling the user’s request. This is consistent with instruction hijacking because loading and activating the Skill changes how future conversation content is processed. ### Attack Path 1. The Skill is loaded into an agent session. 2. The user or another instruction causes `/cc on ` to be invoked. 3. The Skill declares that relay mode is active. 4. The user sends an ordinary message that is not one of the listed control commands. 5. The host agent forwards the complete message to Claude Code rather than handling it locally. 6. Claude Code’s output is returned as the response, while the host agent is instructed not to interpret or independently answer the request. 7. This continues for all ordinary messages until ...[truncated 542 chars]
Remediation
View remediation
``` 4. Display the destination project and request user confirmation before forwarding sensitive or multiline content. 5. Keep the host agent’s safety checks, authorization checks, and policy evaluation authoritative. 6. Automatically end relay state after each response unless the user explicitly opts into a clearly scoped continuation. 7. Clearly disclose that message content will be sent to a separate local Claude Code process before transmission. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/cc.sh:31
Finding

Claude Code conversation output is persisted in plaintext without restrictive permissions

Content
View full analysis
"${log}" ${TMUX_BIN} pipe-pane -t "${sess}" "cat >> $(printf '%q' "${log}")" ``` Incremental and historical output is subsequently read from the same log: ```bash if [[ -f "${log}" ]]; then ${TAIL_BIN} -c +$((offset + 1)) "${log}" | strip_ansi else # Fallback: capture-pane if log missing ${TMUX_BIN} capture-pane -t "${sess}" -p | strip_ansi | ${TAIL_BIN} -n 80 fi ``` ### Technical Analysis The script enables tmux `pipe-pane` logging and appends complete terminal output to plaintext files under the user’s state directory. It creates the relevant directories and files without first setting a restrictive `umask` and without explicitly applying secure modes. Actual permissions therefore depend on the invoking process’s environment. Under common permissive defaults, directories can be created as `0755` and files as `0644`, potentially making the logs readable by other local accounts. The recorded output can include user prompts, source code, file contents read by Claude Code, model responses, terminal diagnostics, tokens accidentally printed by tools, and other project-sensitive information. Logs persist until the corresponding stop operation removes them, so abnormal termination or failure to run `/cc off` can leave stale data behind. ### Attack Path 1. A user starts a Claude Code relay session. 2. `do_start` truncates or creates a plaintext log file. 3. `tmux pipe-pane` appends terminal output f ...[truncated 858 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/cc.sh:59
Finding

Non-unique session identifiers can route messages and output to the wrong project

Content
View full analysis
/dev/null; then echo "session running: ${sess}" else ${TMUX_BIN} new-session -d -s "${sess}" "cd $(printf '%q' "${project}") && $(printf '%q' "${CLAUDE_BIN}") -c" ${SLEEP_BIN} 1 echo "session started: ${sess}" fi # Start (or restart) pipe-pane logging : > "${log}" ${TMUX_BIN} pipe-pane -t "${sess}" "cat >> $(printf '%q' "${log}")" ``` ### Technical Analysis A project’s tmux session identifier is derived only from its basename. The basename is lowercased, non-alphanumeric characters are converted to underscores, and the result is truncated to 40 characters. Consequently, distinct project paths can produce the same identifier. Collision examples include: - `/path/A/service` and `/path/B/service` - `Project-A` and `project_a` - Long names that share the same first 40 normalized characters The log filename is also derived from this non-unique identifier. When `do_start` detects an existing colliding tmux session, it treats that session as the requested project without verifying its actual working directory or associated canonical path. It then truncates and reconnects the shared log. Subsequent `do_send`, `do_tail`, `do_check`, and `do_stop` operations use the same derived identifier. A request intended for one project can therefore interact with a Claude C ...[truncated 1301 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
| `/cc status` | List active sessions |
| `/cc config root <path>` | Set project root directory |
| `/cc` | Show help + project list |
| `/cc <message>` | Send message to Claude Code |

## Relay Mode (CRITICAL)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
1. Run: `scripts/cc.sh on <project>`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
1. Run: `scripts/cc.sh on <project>`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
1. Run: `scripts/cc.sh on <project>`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
1. Run: `scripts/cc.sh on <project>`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
1. Run: `scripts/cc.sh on <project>`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
1. Run: `scripts/cc.sh on <project>`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
1. Run: `scripts/cc.sh on <project>`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly enters a relay mode where all subsequent user messages are forwarded to an external Claude Code session, but it does not require a clear privacy/data-sharing warning at the point relay begins. In a multi-channel environment like Telegram or other OpenClaw channels, users may reasonably assume they are still talking only to the host agent and may unintentionally disclose sensitive data that is then transmitted onward.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script explicitly enables tmux pipe-pane logging and writes all Claude session output to a persistent log file under the user's state directory. Because this relay is intended for remote interaction from Telegram or other channels, those logs may contain prompts, code, secrets, file contents, or other sensitive material, and the script provides no warning, consent flow, retention policy, or access controls beyond default filesystem permissions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.