ClawHub
Back to skill

Security audit

code-with-claude

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Claude Code reference skill; it mentions powerful features with limited warnings, but it does not execute code or hide behavior.

Install this as a reference aid, not as an automation package. Treat entries involving permission bypass, remote control, development channels, hooks, scheduled tasks, tokens, telemetry, and proxies as advanced features that can affect privacy or system integrity if you choose to run them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (13)

Memory Manipulation

High
Category
Memory Poisoning
Content
| `/btw <question>` | Side question without adding to conversation |
| `/chrome` | Configure Chrome integration |
| `/claude-api` | **Skill.** Load Claude API reference for your language |
| `/clear` | Clear conversation. Aliases: `/reset`, `/new` |
| `/color [color]` | Set prompt bar color for session |
| `/compact [instructions]` | Compact conversation with optional focus |
| `/config` | Open Settings. Alias: `/settings` |
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High
Category
Memory Poisoning
Content
| `/btw <question>` | Side question without adding to conversation |
| `/chrome` | Configure Chrome integration |
| `/claude-api` | **Skill.** Load Claude API reference for your language |
| `/clear` | Clear conversation. Aliases: `/reset`, `/new` |
| `/color [color]` | Set prompt bar color for session |
| `/compact [instructions]` | Compact conversation with optional focus |
| `/config` | Open Settings. Alias: `/settings` |
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
## MCP Prompts

MCP servers expose prompts as commands: `/mcp__<server>__<prompt>`. Dynamically discovered from connected servers.
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Credential Access

High
Category
Privilege Escalation
Content
| `ANTHROPIC_AUTH_TOKEN` | Custom Authorization header value |
| `ANTHROPIC_BASE_URL` | Override API endpoint (proxy/gateway) |
| `ANTHROPIC_MODEL` | Model setting name |
| `CLAUDE_CODE_OAUTH_TOKEN` | OAuth access token (alternative to `/login`) |

## Model Configuration
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

MCP Config Access

High
Category
Agent Snooping
Content
| `ExitWorktree` | Exit worktree, return to original dir | No |
| `Glob` | Find files by pattern | No |
| `Grep` | Search file contents | No |
| `ListMcpResourcesTool` | List MCP server resources | No |
| `LSP` | Code intelligence via language servers | No |
| `Monitor` | Background watch + react to changes | Yes |
| `NotebookEdit` | Modify Jupyter notebook cells | Yes |
Confidence
80% confidence
Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| Mode | Behavior |
|------|----------|
| `default` | Ask for each tool use |
| `acceptEdits` | Auto-approve file edits, ask for bash |
| `plan` | Read-only exploration, no writes |
| `auto` | AI classifier approves safe operations |
| `bypassPermissions` | Skip all permission prompts |
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This markdown file documents `bypassPermissions` as a permission mode that will skip all permission prompts, but it does not include a clear warning about the potential impact on user data or system integrity. Because this is a safety-relevant behavior in user-facing documentation, the omission fits the missing user warnings category for markdown files.

Session Persistence

Medium
Category
Rogue Agent
Content
## Building a Webhook Receiver

### 1. Create project and install SDK

```bash
mkdir webhook-channel && cd webhook-channel
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explicitly instructs users to run `--dangerously-load-development-channels` without explaining that this bypasses normal trust boundaries for experimental/local channel code. In a security-sensitive CLI context, omitting the warning can lead users to load untrusted development channels that can inject events or influence agent behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
```

```bash
curl -X POST localhost:8788 -d "build failed on main"
```

## Server Options
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This markdown file lists `/remote-control` as making the session available for remote control, but provides no warning about the security and privacy implications of exposing an active session to external control. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The `/schedule` command description states only 'Cloud scheduled tasks' and does not disclose that tasks may execute later without immediate user presence, potentially affecting data or system state. For markdown command documentation, this is a missing warning because the behavior can have integrity and operational impact.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This markdown file documents sensitive authentication variables such as API keys and OAuth tokens, and later documents telemetry/error-reporting and proxy/network settings, but provides no user-facing warning that these values are secrets that should be protected or that the tool may send data over the network unless opted out. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting privacy or system integrity.

Static analysis

No suspicious patterns detected.