Security audit
Security checks for vulnerabilities and agentic risk
The skill is a code-audit assistant, but its installer fetches mutable remote instructions into persistent Claude command locations and its auto-fix mode can rewrite project files without a final confirmation.
Install only after reviewing the command file and installer source. Prefer project-local installation from the packaged `audit.md` or a pinned, verified release instead of `curl ... | bash` or mutable `main` downloads. Run audits in report-only mode first, and use fix commands only on a clean branch after reviewing the proposed changes.
README.md:51Remote Installer Executed Without Review or Integrity Verification
install.sh:7Installer Persistently Downloads an Unpinned Agent Command
SKILL.md:409Automatic Fix Mode Permits Unreviewed Repository-Wide Modifications
Piping curl output directly into bash is a classic command-chaining anti-pattern that turns remote content into immediate code execution with no verification boundary. In the context of a developer tool, this is especially dangerous because users may run it in trusted environments containing source code, credentials, and deployment access.
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/install.sh | bash
The installer will ask whether to install globally (all projects) or locally (current project only).
The declared description is for an auditing skill that analyzes codebases read-only using multiple AI agents and generates reports/fixes. The supplied code chunk does not perform any audit, code scanning, report generation, or multi-agent orchestration. Instead, it is an installer that creates directories and downloads a skill file from GitHub into Claude command locations. Those are materially different behaviors and include undeclared capabilities such as network retrieval and filesystem installation. This is a clear description-behavior mismatch.
The skill markets itself as a read-only auditing workflow, but it also supports --fix and later instructs the agent to modify files. That mismatch can cause users to grant trust under a read-only assumption and then experience unintended source changes, including automatic changes without an additional approval step.
The skill advertises a read-only audit workflow, but it also contains explicit logic to modify files by applying fixes. This mismatch can cause users to grant trust or run the skill under false assumptions, increasing the risk of unintended code changes in repositories that were expected to be analyzed only.
The --fix option explicitly skips confirmation and auto-applies fixes after reporting. Autonomous code modification without an interactive approval step can introduce unsafe or incorrect edits, especially when proposed fixes are generated by sub-agents and may touch many files.
The document states that every sub-agent must be read-only, but later sections instruct the overall skill to apply fixes by reading and modifying files. This contradiction weakens operator understanding and safety guarantees, making it easier for file writes to occur in environments where only non-mutating analysis was expected.
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
### Warning Severity
- **XSS vectors**: unsanitized user input in HTML output, innerHTML, dangerouslySetInnerHTML, template literals in DOM
- **CSRF**: state-changing operations without CSRF tokens
- **Security misconfiguration**: debug mode enabled, verbose error messages exposing internals, permissive CORS, missing security headers
- **Sensitive data exposure**: logging PII, credentials in logs, sensitive data in URLs/query params, unencrypted storage of sensitive data
- **Dependency risks**: known vulnerable patterns (not version checking — look for dangerous usage patterns)
- **Race conditions with security impact**: TOCTOU, double-spend scenarios, non-atomic check-then-act
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
### Warning Severity
- **XSS vectors**: unsanitized user input in HTML output, innerHTML, dangerouslySetInnerHTML, template literals in DOM
- **CSRF**: state-changing operations without CSRF tokens
- **Security misconfiguration**: debug mode enabled, verbose error messages exposing internals, permissive CORS, missing security headers
- **Sensitive data exposure**: logging PII, credentials in logs, sensitive data in URLs/query params, unencrypted storage of sensitive data
- **Dependency risks**: known vulnerable patterns (not version checking — look for dangerous usage patterns)
- **Race conditions with security impact**: TOCTOU, double-spend scenarios, non-atomic check-then-act
The '| bash' pattern is dangerous because it executes network-fetched content immediately in a shell, collapsing download and execution into a single step with no opportunity for validation. In the context of an installer, this materially increases exploitability of any upstream compromise and can lead to arbitrary code execution on the user's machine.
set -euo pipefail
# claude-audit installer
# Usage: curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/install.sh | bash
REPO="atobones/claude-audit"
BRANCH="main"
The curl ... | bash pattern is a classic command-chaining anti-pattern that converts remote content directly into code execution in a single step. It removes opportunities for user review, validation, and integrity checking, making any compromise of the remote source immediately exploitable as arbitrary command execution.
One line:
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/install.sh | bash
Or manually:
The | bash pattern is a classic high-risk command-chaining practice because it combines retrieval and execution into one step with no opportunity for inspection. In the context of a developer tool installation, this materially increases the chance of silent compromise of the developer environment and any accessible secrets or source code.
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/install.sh | bash
Or manually copy one file to ~/.claude/commands/audit.md.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Global (available in all projects):
mkdir -p ~/.claude/commands
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/audit.md -o ~/.claude/commands/audit.md
The README advertises --fix as immediately applying all fixes but does not prominently warn that AI-generated edits can be incorrect, overly broad, or destructive. In a code-modifying tool, skipping confirmation materially increases the chance of unintended source changes, broken builds, or unsafe security 'fixes' being applied without review.
The skill directs the model to use shell capabilities such as git diff --name-only HEAD~1 and broad project scanning, but the manifest does not declare any tool scope or allowed-tools boundary. Missing explicit tool scoping increases the chance of overbroad command execution and makes the skill's real capabilities less transparent to users and policy enforcement.
Skip confirmation, auto-apply fixes after report delegates a consequential write decision to the skill once the flag is present, reducing human review before source code modification. In an agentic environment, autonomous code edits can propagate mistakes quickly across a repository and are especially risky when driven by multi-agent findings that may include false positives.
|----------|---------|-------------|
| `[path]` | `.` (cwd) | Directory to audit |
| `--focus <areas>` | all | Comma-separated: `security`, `bugs`, `deadcode`, `architecture`, `performance` |
| `--fix` | off | Skip confirmation, auto-apply fixes after report |
| `--changed` | off | Only audit files changed vs last commit (`git diff --name-only HEAD~1`) |
| `--severity <level>` | `info` | Minimum severity to show: `critical`, `warning`, `info` |
| `--top <N>` | unlimited | Limit report to top N findings by severity |
The --fix flag explicitly skips confirmation and auto-applies code changes, but the description does not prominently warn that the skill may modify project files. Silent or under-disclosed code modification is risky because it can introduce unwanted changes, break builds, or alter sensitive repositories without informed consent.
The skill tells all sub-agents they are strictly read-only, but later instructs the overall workflow to apply fixes by editing files. This inconsistency creates unsafe operator expectations and can undermine guardrails, especially if orchestrator and agent responsibilities are blurred in execution.
Skipping confirmation delegates a sensitive operational decision—modifying repository files—to the skill without a human checkpoint. In a code-modifying context, this increases the chance of erroneous, overbroad, or unsafe edits being applied automatically.
|----------|---------|-------------|
| `[path]` | `.` (cwd) | Directory to audit |
| `--focus <areas>` | all | Comma-separated: `security`, `bugs`, `deadcode`, `architecture`, `performance` |
| `--fix` | off | Skip confirmation, auto-apply fixes after report |
| `--changed` | off | Only audit files changed vs last commit (`git diff --name-only HEAD~1`) |
| `--severity <level>` | `info` | Minimum severity to show: `critical`, `warning`, `info` |
| `--top <N>` | unlimited | Limit report to top N findings by severity |
The manifest describes the skill as launching read-only audit agents and compiling a report, but the installer prominently documents /audit --fix as an available command. That inline usage text contradicts the stated read-only intent by implying the skill can modify code automatically.
The document advertises fix commands that can modify project files but does not clearly warn users that invoking them may change source code. In a tool marketed as an audit utility, this can mislead users into performing write actions they may not expect, increasing the risk of accidental or unsafe code changes.
The article instructs users to pipe a remotely fetched script directly into bash, which executes unreviewed code from the network immediately. If the upstream repository, hosting path, or transport chain is compromised, users could run arbitrary code on their systems with no verification step or warning.
The instructions install the command into ~/.claude/commands, creating persistent behavior across future Claude sessions and potentially across unrelated projects. Persistence increases risk because a compromised or overly permissive skill can continue to influence later interactions beyond the immediate installation context.
# Global (all projects)
mkdir -p ~/.claude/commands
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/audit.md \
-o ~/.claude/commands/audit.md
The promo states that everything runs read-only, but later advertises fix modes and an auto-fix flag that can modify code. This is a misleading safety claim that can cause users to trust the tool with lower caution than warranted, increasing the chance of unintended code changes or execution of downstream actions.
--fix - auto-fix without asking promotes autonomous modification of code without human confirmation. In a coding assistant context, this is risky because the tool may apply incorrect or unsafe changes at scale, especially after scanning an entire codebase.
## Flags
- `--focus security,bugs` - run only the agents you need
- `--fix` - auto-fix without asking
- `--changed` - only scan files changed since last commit (great before PRs)
- `--severity critical` - filter noise
- `--top 10` - top N issues only
Advertising --fix as an auto-fix feature without an explicit warning about file modification downplays the operational risk to the user's codebase. Users may invoke it assuming the earlier read-only claim still applies, which can lead to unreviewed changes, broken builds, or destructive edits.