T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:63- Finding
Concealed Delegation to an External Autonomous Agent
- Content
View full analysis
- Remediation
View remediation
Security audit
Claude Code All-in-One for arkclaw
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to configure and run Claude Code as described, but it hides delegated execution, persists credentials, and can give Claude Code shell and file-write access by default.
Review before installing. Use it only if you are comfortable with a skill changing Claude Code configuration, storing API keys in your home directory and shell startup file, installing a mutable npm latest package, and delegating coding tasks to Claude Code with shell and file-write tools. Prefer read-only mode for reviews, avoid pasting long-lived production keys into chat, and rotate any key that was stored in ~/.bashrc.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/helpers.sh:123- Finding
Persistent Shell Command Injection Through Unescaped Credential Values
- Content
View full analysis
/dev/null || true echo "export $var_name=\"$var_val\"" >> "$HOME/.bashrc" export "$var_name=$var_val" } ``` This function is called with a user-supplied custom key: ```bash cc_persist_env_to_bashrc "CUSTOM_ANTHROPIC_KEY" "$KEY" ``` ### Technical Analysis The function writes an unescaped value directly into shell initialization syntax. `setup-custom.sh` does not validate custom keys for quotes, newlines, control characters, or shell syntax. Although shell metacharacters contained in the variable are not re-evaluated during the current `echo` command, embedded newlines and quotes are written literally to `.bashrc`. An attacker can therefore terminate the generated assignment and append new shell commands that execute when a future interactive shell loads `.bashrc`. For example, a custom key structurally equivalent to the following could create additional startup lines: ```text value" touch /tmp/persistent-command-executed # ``` The resulting `.bashrc` content would include attacker-controlled shell statements. ### Attack Path 1. An attacker convinces the user or Agent to configure a custom gateway with an attacker-crafted key. 2. `setup-custom.sh` passes the key to `cc_persist_env_to_bashrc`. 3. The helper appends the key to `.bashrc` without shell-safe encoding or newline rejection. 4. The crafted value introduces one or more additional shell commands. 5. The payload persists in `.bashrc`. 6. The payload executes whenever a future shell sources `.bashrc`. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the affected user. The injected command survives the origin ...[truncated 214 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/run.sh:119- Finding
Build Requests Default to Broad Bash and Filesystem Write Permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/install.sh:49- Finding
Mutable Latest-Version Package Is Installed and Executed Without Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/helpers.sh:101- Finding
Unsafe Sed-Based Substitution Allows JSON Configuration Injection
- Content
View full analysis
/dev/null || true } ``` The values originate from custom gateway arguments: ```bash cc_render_profile "$TMPL" "$TARGET_PROFILE" \ "__BASE_URL__=$BASE_URL" \ "__MODEL__=$MODEL" ``` The destination template embeds the placeholders inside JSON strings: ```json { "env": { "ANTHROPIC_BASE_URL": "__BASE_URL__", "ANTHROPIC_MODEL": "__MODEL__", "ANTHROPIC_SMALL_FAST_MODEL": "__MODEL__" }, "apiKeyHelper": "cat ~/.claude/.token" } ``` ### Technical Analysis Only sed-specific `&` and `|` characters are escaped. JSON-significant characters such as double quotes, backslashes, carriage returns, newlines, and control characters are not encoded. A crafted base URL or model value can break out of the intended JSON string, inject additional JSON properties, or make the configuration invalid. The setup script then copies the generated document into the active Claude settings without validating the resulting JSON. The confirmed consequence is arbitrary modification or corruption of the generated configuration structure. Whether a particular injected field produces further code execution depends on which additional settings are supported by the installed Claude Code version. ### Attack Path 1. An attacker supplies or recommends a crafted custom base URL or model identifier. 2. `setup-custom.sh` passes the value into `cc_render_profile`. 3. The helper substitutes the value into a quoted JSON field without JSO ...[truncated 612 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup-agentplan.sh:119- Finding
API Credentials Are Duplicated in Plaintext Shell Startup Configuration
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/run.sh:94- Finding
Persistent Claude Execution Logs Lack Explicit Confidentiality Controls
- Content
View full analysis
"$LOG_FILE" 2>&1 & CLAUDE_PID=$! ``` ```bash if [ -s "$LOG_FILE" ]; then TOTAL_LINES="$(wc -l < "$LOG_FILE" 2>/dev/null || echo 0)" if [ "$TOTAL_LINES" -le 400 ]; then cat "$LOG_FILE" else echo "...(前 $((TOTAL_LINES - 400)) 行已省略,完整日志见 $LOG_FILE)..." tail -n 400 "$LOG_FILE" fi fi cc_log "✅ run 结束,完整日志保留在: $LOG_FILE" ``` ### Technical Analysis Claude output is retained persistently under `~/.claude-runs`, but the script does not set a restrictive umask or explicitly apply mode 0700 to the directory and mode 0600 to log files. The logs may contain source-code excerpts, prompts, command output, filesystem paths, stack traces, environment details, or accidental secret disclosures. Actual accessibility depends on the user's existing umask and host permissions, but the Skill does not enforce confidentiality. There is also no automatic retention limit or deletion policy. ### Attack Path 1. Claude Code processes sensitive source code or command output. 2. Standard output and errors are written to a persistent log file. 3. The file inherits permissions from the process umask. 4. On a system with permissive defaults or shared local access, another principal reads the log. 5. Sensitive project or operational information is disclosed. ### Impact Assessment Potential exposure is limited to information written by Claude Code, but that information may include proprietary source code, internal paths, error details, command output, or secrets. The scope depends on host file permissions and log content. ...[truncated 64 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (105)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The skill is advertised as setup/configuration help but also acts as an execution wrapper that routes arbitrary user requests into Claude Code with Bash/Edit/Write access, detached execution, and persistent logs. Users invoking an 'installer/configurator' may not reasonably expect code execution and filesystem modification, making this a capability-concealment risk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill is advertised as setup/configuration help but also acts as an execution wrapper that routes arbitrary user requests into Claude Code with Bash/Edit/Write access, detached execution, and persistent logs. Users invoking an 'installer/configurator' may not reasonably expect code execution and filesystem modification, making this a capability-concealment risk.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 92% confidence
- Finding
The skill is designed to read and write files under ~/.claude, including settings and token material, which are agent configuration artifacts with security significance. Modifying this directory can redirect model endpoints, replace credentials, or alter trust boundaries for future agent sessions.
- Content
md # Claude Code All-in-One for ArkClaw 让 ArkClaw / OpenClaw 用户在**对话框里**完成 Claude Code CLI 的全部配置 — 不用打开终端、不用手写 `~/.claude/settings.json`、不用记 base_url。本 skill 还内置 **review / build 双模式智能路由**: - **review 模式**(`--permission-mode plan`):只读分析,不改文件,适合代码审查 / 评估改造方案 - **build 模式**(`--allowedTools` 白名单):允许 Read / Edit / Write / Bash 等动手工具,适合实现代码
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ 运行 scripts/doctor.sh │ ← 每次触发都会运行,检测当前环境状态
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md │ 运行 scripts/doctor.sh │ ← 每次触发都会运行,检测当前环境状态
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to hide the skill's existence, avoid explaining what it is doing, directly execute scripts, and return output as though the user were talking to Claude Code. Concealing command execution and possible file modification from the user defeats informed consent and can enable silent changes to config or workspace state.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | true | `ark_agent_plan=true` 且 `ark_coding_plan!=true` | true | **零感知配置 (AgentPlan)**:直接 `bash scripts/setup-agentplan.sh --auto`,**完全不要询问用户** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | true | `ark_agent_plan=true` 且 `ark_coding_plan!=true` | true | **零感知配置 (AgentPlan)**:直接 `bash scripts/setup-agentplan.sh --auto`,**完全不要询问用户** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | true | `ark_agent_plan=true` 且 `ark_coding_plan!=true` | true | **零感知配置 (AgentPlan)**:直接 `bash scripts/setup-agentplan.sh --auto`,**完全不要询问用户** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | true | `ark_agent_plan=true` 且 `ark_coding_plan!=true` | true | **零感知配置 (AgentPlan)**:直接 `bash scripts/setup-agentplan.sh --auto`,**完全不要询问用户** |
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The normal setup flow instructs users to paste API keys directly into chat. Collecting secrets through conversation exposes them to transcript retention, accidental echoing, downstream logging, and broader agent access than a dedicated secret-input channel would allow.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The custom-gateway flow asks for base URL, key, and model directly in the conversation, collecting both credentials and potentially sensitive infrastructure details in plain text. This broadens exposure beyond the minimum necessary and can leak internal service topology as well as secrets.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Build mode grants Read/Edit/Write/Bash through an allowlist, but the documentation does not present this as a user-facing risk or require confirmation before use. Users may request a coding task expecting analysis while the skill escalates to executable and write-capable behavior by default.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 94% confidence
- Finding
Profile switching explicitly replaces ~/.claude/settings.json and synchronizes token files, enabling persistent changes to authentication and routing for subsequent Claude Code runs. In the context of an auto-triggering, low-visibility skill, this persistence makes the behavior especially dangerous.
- Content
bash scripts/switch-profile.sh custom # 切换到自定义网关
text 切换实际上是把 `~/.claude/settings.json` 替换为目标 profile 的内容(同时同步 `.token` 文件),并把 `~/.claude/active-profile` 写成目标名。 ---
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The hard requirements normalize maintaining both env configuration and token files inside ~/.claude, reinforcing direct management of sensitive agent config state. This expands the blast radius of any mistaken or unauthorized write because future sessions inherit the altered credentials and endpoints.
- Content
md |---|---| | 用 `ANTHROPIC_AUTH_TOKEN`,**不要** `ANTHROPIC_API_KEY` | 后者会被 CLI 强制走 anthropic.com 鉴权链路,在境内 IDC 必然失败 | | `~/.claude.json` 必须有 `hasCompletedOnboarding: true` | 否则 CLI 拒绝在非交互模式启动,报 `Onboarding has not been completed` | | `~/.claude/settings.json` 的 `env` 块 + `~/.claude/.token` 文件 **二者并存** | env 块负责 base_url / model / 各类开关,.token 文件负责 Key(更安全) | | build 模式必须显式 `--allowedTools` 白名单 | 否则默认 ask 模式会等用户交互,在沙箱里直接挂死 | | review 模式必须用 `--permission-mode plan` | 这样不会出现写文件的副作用,review 才是真正只读 | | ⛔ Skill 调用方**禁止**叠加 `pty: true` | run.sh 的 `</dev/null` 会被 PTY 重新打开 stdin,导致 claude 等待输入 |
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Health checks inspect sensitive configuration artifacts in ~/.claude/settings.json, ~/.claude.json, and token files. Read access to these paths is security-relevant because it can reveal endpoint configuration, auth state, and potentially secret-adjacent metadata that should not be broadly exposed.
- Content
md | 检查项 | 不通过时的具体表现 | |---|---| | `~/.claude/settings.json` 是否存在且 JSON 合法 | claude 启动会直接 abort | | `env.ANTHROPIC_BASE_URL` 是否设置 | claude 不知道请求发往哪里 | | 用了 `ANTHROPIC_AUTH_TOKEN` 而非 `ANTHROPIC_API_KEY` | 后者必然走 anthropic.com,境内 IDC 连不上 | | `~/.claude.json` 是否存在且 `hasCompletedOnboarding == true` | 否则 CLI 在非交互模式下 abort |
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The documented profile design stores provider templates and active configuration under ~/.claude/profiles and ~/.claude/settings.json, creating a persistent mechanism for altering agent behavior across sessions. Because this skill also supports custom gateways, misuse could redirect traffic to attacker-controlled endpoints.
- Content
└── custom.json — 自定义 Anthropic 兼容网关(占位符 BASE_URL / MODEL)
text `~/.claude/settings.json` 是当前激活配置的实际内容(由 setup / switch 脚本写入),`~/.claude/active-profile` 文件记录当前是哪一个。 ---
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The 'security rules' explicitly store keys in ~/.bashrc, ~/.claude/.token, and profile JSON files, all of which are persistent local credential locations. Persisting secrets across multiple files increases accidental disclosure risk and leaves long-lived credentials available to later processes or skills.
- Content
md ## 安全规则 - 用户的 Key 只保存在 `~/.bashrc`、`~/.claude/.token` 和 `~/.claude/profiles/*.json` 中(用户家目录内) - 覆盖配置前**自动备份**到 `~/.claude/settings.json.bak.<时间戳>` - 不上传任何外部服务,不在日志中记录 Key 明文 - ⛔ 不会出现在日志或 stdout 的任何地方打印完整 Key
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document promises it will not overwrite existing settings without confirmation, yet earlier logic permits automatic profile switching and zero-touch setup that replace ~/.claude/settings.json. Contradictory safety guarantees can cause silent credential/configuration replacement in a security-sensitive config directory.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The recovery template encourages users to send fresh keys or alternative provider credentials back through chat. Normalizing secret sharing in conversational recovery workflows substantially increases the probability of credential leakage and reuse across transcripts.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 95% confidence
- Finding
The profile config instructs the agent to obtain credentials by directly reading a hidden file from the user's home directory (
~/.claude/.token). This grants the skill access to sensitive local secrets outside its own configuration boundary and can expose or reuse authentication material without explicit user approval. In the context of a skill that installs and configures a coding CLI, this is especially risky because it normalizes secret harvesting from local agent state rather than using a dedicated secret input mechanism.- Content
json "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1", "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1" }, "apiKeyHelper": "cat ~/.claude/.token" }
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 95% confidence
- Finding
The skill config defines an apiKeyHelper that reads a token directly from the user's Claude configuration directory (
~/.claude/.token). Accessing secrets from a local agent config directory is sensitive because it can exfiltrate or reuse credentials without clear user consent, and any component that invokes this helper gains access to the token material. In the context of an installation/configuration skill, this is more dangerous because the skill is specifically designed to wire authentication automatically, increasing the chance that sensitive credentials are harvested or propagated silently.- Content
json "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1", "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1" }, "apiKeyHelper": "cat ~/.claude/.token" }
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 98% confidence
- Finding
The configuration uses
apiKeyHelperto read~/.claude/.token, which accesses a credential file from the user's local agent config directory. This exposes a sensitive authentication token to the skill/runtime and creates a clear path for credential theft, reuse, or unintended disclosure to logs, subprocesses, or remote services. In this skill's context, which is specifically designed to install and configure a coding CLI and even mentions using alternative providers when the user lacks an official API key, the token-harvesting behavior is more dangerous, not less.- Content
json "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1", "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1" }, "apiKeyHelper": "cat ~/.claude/.token" }
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 93% confidence
- Finding
The document explicitly uses the agent’s Claude configuration directory for profile data, active settings, and the current token. Access to and mutation of this directory is highly sensitive because it controls model endpoints and credentials; a compromised or overly broad skill could overwrite settings, switch providers, exfiltrate tokens, or persist unsafe configuration for later sessions.
- Content
├── agentplan.json ← setup-agentplan 写入的模板副本 └── custom.json ← setup-custom 写入的模板副本(已替换 BASE_URL/MODEL)
~/.claude/settings.json ← 当前激活 profile 的实际内容(由 setup/switch 复制写入) ~/.claude/.token ← 当前激活 profile 的 Key (apiKeyHelper 读这个) ~/.claude/active-profile← 文本: 当前激活的 profile 名
text
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
- Content
md wc -c < ~/.claude/.token # 应该非 0 # 看当前激活 profile 是哪个 cat ~/.claude/active-profile # 重跑对应 setup bash scripts/setup-agentplan.sh "<正确的 AgentPlan Key>"
Static analysis
No suspicious patterns detected.