code-with-claude

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:56 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only Claude Code reference skill; it mentions powerful features with limited warnings, but it does not execute code or hide behavior.

Install this as a reference aid, not as an automation package. Treat entries involving permission bypass, remote control, development channels, hooks, scheduled tasks, tokens, telemetry, and proxies as advanced features that can affect privacy or system integrity if you choose to run them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (13)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

| `/btw <question>` | Side question without adding to conversation |
| `/chrome` | Configure Chrome integration |
| `/claude-api` | **Skill.** Load Claude API reference for your language |
| `/clear` | Clear conversation. Aliases: `/reset`, `/new` |
| `/color [color]` | Set prompt bar color for session |
| `/compact [instructions]` | Compact conversation with optional focus |
| `/config` | Open Settings. Alias: `/settings` |

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/commands.md (reported line 16)May include surrounding context.

md

| `/btw <question>` | Side question without adding to conversation |
| `/chrome` | Configure Chrome integration |
| `/claude-api` | **Skill.** Load Claude API reference for your language |
| `/clear` | Clear conversation. Aliases: `/reset`, `/new` |
| `/color [color]` | Set prompt bar color for session |
| `/compact [instructions]` | Compact conversation with optional focus |
| `/config` | Open Settings. Alias: `/settings` |

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/commands.md (reported line 64)May include surrounding context.

md

## MCP Prompts

MCP servers expose prompts as commands: `/mcp__<server>__<prompt>`. Dynamically discovered from connected servers.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/env-vars.md (reported line 13)May include surrounding context.

md

| `ANTHROPIC_AUTH_TOKEN` | Custom Authorization header value |
| `ANTHROPIC_BASE_URL` | Override API endpoint (proxy/gateway) |
| `ANTHROPIC_MODEL` | Model setting name |
| `CLAUDE_CODE_OAUTH_TOKEN` | OAuth access token (alternative to `/login`) |

## Model Configuration

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · references/tools.md (reported line 22)May include surrounding context.

md

| `ExitWorktree` | Exit worktree, return to original dir | No |
| `Glob` | Find files by pattern | No |
| `Grep` | Search file contents | No |
| `ListMcpResourcesTool` | List MCP server resources | No |
| `LSP` | Code intelligence via language servers | No |
| `Monitor` | Background watch + react to changes | Yes |
| `NotebookEdit` | Modify Jupyter notebook cells | Yes |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

| Mode | Behavior |
|------|----------|
| `default` | Ask for each tool use |
| `acceptEdits` | Auto-approve file edits, ask for bash |
| `plan` | Read-only exploration, no writes |
| `auto` | AI classifier approves safe operations |
| `bypassPermissions` | Skip all permission prompts |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents bypassPermissions as a permission mode that will skip all permission prompts, but it does not include a clear warning about the potential impact on user data or system integrity. Because this is a safety-relevant behavior in user-facing documentation, the omission fits the missing user warnings category for markdown files.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/channels.md (reported line 22)May include surrounding context.

Building a Webhook Receiver

1. Create project and install SDK

bash

mkdir webhook-channel && cd webhook-channel

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly instructs users to run --dangerously-load-development-channels without explaining that this bypasses normal trust boundaries for experimental/local channel code. In a security-sensitive CLI context, omitting the warning can lead users to load untrusted development channels that can inject events or influence agent behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/channels.md (reported line 80)May include surrounding context.

text

```bash
curl -X POST localhost:8788 -d "build failed on main"

Server Options

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file lists /remote-control as making the session available for remote control, but provides no warning about the security and privacy implications of exposing an active session to external control. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The /schedule command description states only 'Cloud scheduled tasks' and does not disclose that tasks may execute later without immediate user presence, potentially affecting data or system state. For markdown command documentation, this is a missing warning because the behavior can have integrity and operational impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file documents sensitive authentication variables such as API keys and OAuth tokens, and later documents telemetry/error-reporting and proxy/network settings, but provides no user-facing warning that these values are secrets that should be protected or that the tool may send data over the network unless opted out. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting privacy or system integrity.

Content

No source excerpt is available for this finding.