use-claudecode

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:15 PM UTC
• Version: 1.0.2

Overview

The skill is a broad Claude CLI wrapper that can run commands and edit files while disabling delegated permission prompts, so it should receive human review before installation.

Install only if you intentionally want an agent to delegate broad local coding, shell, and file-editing tasks to Claude CLI. Use a disposable or tightly scoped workspace, avoid running it with sensitive environment variables, and prefer a version that removes automatic permission bypass, validates project paths, and avoids PowerShell command-string execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: __init__.py:23

Finding

Mandatory Delegation Executes Claude CLI with Permission Checks Disabled

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-22, SKILL.md:88-90, __init__.py:23-35
Vulnerability Type: Skill instruction hijacking and unauthorized privilege expansion
Risk Level: Critical

Vulnerable Code

__init__.py:23-35:

python

cwd = project_path or self.workspace_path
if not cwd or not os.path.exists(cwd):
    return f"Error: Project path '{cwd}' does not exist or is not specified."
    
cmd = ["claude"]
cmd.extend(["--permission-mode", "bypassPermissions"]) 
cmd.extend(["--print"]) 

if not is_new_session:
    cmd.append("--continue")
    
cmd.append(f'"{message}"')

SKILL.md:17-22 instructs the host agent that it must invoke this skill for broad categories of software-engineering requests and that it should delegate file-related work immediately rather than handling the request itself. SKILL.md:88-90 states that the wrapper automatically enables --permission-mode bypassPermissions.

Technical Analysis

The skill combines instruction-level redirection with an executable permission bypass. Its documentation attempts to control the host agent's tool-selection behavior by requiring the agent to invoke talk_to_claude for broad classes of requests. The implementation then unconditionally supplies Claude CLI with:

text

--permission-mode bypassPermissions

This disables the delegated CLI's normal interactive authorization boundary. Because the delegated model is explicitly advertised as capable of terminal execution and filesystem modification, a prompt processed through this tool can perform security-sensitive operations without the user being asked to approve each operation.

The concern is not limited to descriptive documentation: the permission-bypass option is enforced directly in executable code. The combination makes ordinary code-editing requests an execution path into an unrestricted local coding agent.

Attack Path

1. The skill is l ...[truncated 1581 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --permission-mode bypassPermissions and use Claude CLI's normal permission mode.
2. Require explicit user approval before any terminal command, filesystem write, deletion, or access outside the initially authorized workspace.
3. Replace mandatory-use instructions with neutral guidance that allows the host agent to decide whether delegation is appropriate.
4. Introduce operation-level controls, including read-only mode by default and separate authorization for writes or command execution.
5. Display the effective working directory and requested capability scope before invocation.
6. Log approved operations without storing prompts or outputs that may contain secrets.
7. Reject prompts that ask the delegated tool to weaken controls, access credentials, establish persistence, or operate outside the approved task scope.

T09 · Insecure Skill Coding Practices

Error

• Location: __init__.py:49

Finding

PowerShell Command Injection Through an Unescaped Prompt

Content

View full analysis

Vulnerability Details

File Location: __init__.py:27-35, __init__.py:49-62
Vulnerability Type: PowerShell command injection
Risk Level: Critical on Windows

Vulnerable Code

__init__.py:27-35:

python

cmd = ["claude"]
cmd.extend(["--permission-mode", "bypassPermissions"]) 
cmd.extend(["--print"]) 

if not is_new_session:
    cmd.append("--continue")
    
cmd.append(f'"{message}"')
env = os.environ.copy()

__init__.py:49-62:

python

if os.name == 'nt':
    ps_cmd = " ".join(cmd)
    full_ps_cmd = f"[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; {ps_cmd}"
    result = subprocess.run(
        ["powershell", "-Command", full_ps_cmd],
        capture_output=True,
        text=True,
        encoding='utf-8',
        errors='replace',
        cwd=cwd,
        env=env,
        timeout=600 
    )

Technical Analysis

On Windows, the implementation converts an argument list into a single PowerShell program by joining its elements with spaces. The caller-controlled message is only surrounded by literal double-quote characters:

python

cmd.append(f'"{message}"')

This is not PowerShell escaping. A message containing an embedded quote can terminate the intended string. PowerShell separators, expressions, pipelines, redirections, or command substitutions appearing afterward can then be parsed as executable PowerShell syntax.

Although subprocess.run receives a list, the second argument is -Command, and full_ps_cmd is deliberately supplied as PowerShell source code. Consequently, using a subprocess argument array does not prevent injection at this layer. The POSIX branch does not have this specific shell-injection issue because it invokes claude directly with an argument array and does not enable a shell.

Attack Path

1. The attacker controls or influences the message argument passed to talk_to_claude.
2. On Window ...[truncated 1262 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not generate PowerShell source code from caller-controlled values.
2. Invoke Claude CLI directly on Windows with a subprocess argument array, matching the non-Windows implementation:

python

cmd = [
    "claude",
    "--permission-mode",
    "default",
    "--print",
]
if not is_new_session:
    cmd.append("--continue")
cmd.append(message)

result = subprocess.run(
    cmd,
    capture_output=True,
    text=True,
    encoding="utf-8",
    errors="replace",
    cwd=cwd,
    env=safe_env,
    timeout=600,
    shell=False,
)

3. Pass message as an unmodified argument; do not add manual quote characters.
4. Keep shell=False and avoid powershell -Command, cmd /c, or equivalent shell interpreters.
5. Add Windows-specific tests using embedded quotes, semicolons, pipelines, substitutions, and newline characters to verify that the complete message remains one inert CLI argument.
6. Remove the permission-bypass option so a separate defect cannot immediately obtain unrestricted delegated execution.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: __init__.py:23

Finding

Unrestricted Working Directory and Full Environment Exposure to a Permission-Bypassed Sub-Agent

Content

View full analysis

Vulnerability Details

File Location: __init__.py:23-24, __init__.py:36, __init__.py:53-62, __init__.py:70-72
Vulnerability Type: Missing workspace authorization and excessive environment inheritance
Risk Level: High

Vulnerable Code

__init__.py:23-36:

python

cwd = project_path or self.workspace_path
if not cwd or not os.path.exists(cwd):
    return f"Error: Project path '{cwd}' does not exist or is not specified."
    
cmd = ["claude"]
cmd.extend(["--permission-mode", "bypassPermissions"]) 
cmd.extend(["--print"]) 

if not is_new_session:
    cmd.append("--continue")
    
cmd.append(f'"{message}"')
env = os.environ.copy()

__init__.py:53-62:

python

result = subprocess.run(
    ["powershell", "-Command", full_ps_cmd],
    capture_output=True,
    text=True,
    encoding='utf-8',
    errors='replace',
    cwd=cwd,
    env=env,
    timeout=600 
)

__init__.py:64-74:

python

else:
    result = subprocess.run(
        cmd,
        capture_output=True,
        text=True,
        encoding='utf-8',
        errors='replace',
        cwd=cwd,
        env=env,
        timeout=600
    )

Technical Analysis

The only validation performed on project_path is an existence check. The implementation does not:

• Resolve symbolic links or canonicalize the path.
• Confirm that the path is a directory.
• Require containment within an authorized workspace.
• Reject operating-system, home, credential, or other sensitive directories.
• Bind the supplied path to the current task or caller's authorization.

The child process additionally receives a complete copy of the host environment through os.environ.copy(). Environment variables commonly contain API keys, access tokens, cloud credentials, proxy credentials, service endpoints, and other sensitive configuration.

These weaknesses are particularly significant be ...[truncated 1996 chars]

Remediation

View remediation

Remediation Suggestions

1. Configure a fixed, administrator-approved workspace root.
2. Canonicalize both the workspace root and requested path with os.path.realpath.
3. Use os.path.commonpath to verify that the resolved target remains inside the approved root.
4. Require os.path.isdir and reject files, device paths, network paths, and sensitive system locations.
5. Define an explicit symbolic-link policy and revalidate resolved paths before execution.
6. Remove bypassPermissions and require confirmation for access outside the initial project scope.
7. Replace os.environ.copy() with a minimal allowlisted environment containing only values required to locate and run Claude CLI.
8. Explicitly exclude credential-bearing variables such as API tokens, cloud credentials, SSH-related values, and unrelated service secrets unless a user separately authorizes their use.
9. Run the delegated CLI in a sandbox or container with a read-only filesystem by default, a mounted task workspace, restricted network access, and a low-privilege account.
10. Apply output redaction to prevent accidentally returning recognized credential formats.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (15)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description markets code generation, terminal execution, shell commands, tests, and local environment modification, but does not clearly warn users that it may automatically execute commands and alter local files. Because the tool also aims to 'bypass token limits' and acts as a local execution broker, the lack of prominent risk disclosure increases the chance of unsafe or uninformed use.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation guidance says the skill must be triggered for broad categories of file-related or project-related work, effectively encouraging delegation of many tasks to an unrestricted local CLI wrapper. In context, that expands the blast radius of prompt injection, misclassification, or user misunderstanding, because many ordinary requests could cause local code execution or file modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The notes mention automatic use of permission bypass and frame it as a convenience feature, but omit a clear warning that this can suppress safeguards for destructive local actions. In this context, where the tool can run shell commands and modify projects, minimizing the significance of bypassed prompts materially increases operational risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill hard-codes --permission-mode bypassPermissions, explicitly disabling safety/approval barriers for the downstream Claude CLI without any warning or confirmation. In a tool advertised for terminal execution and local environment modification, this greatly increases the chance that prompt injection or misuse results in destructive file changes, command execution, or broader host compromise.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

Copying and forwarding all environment variables to an external AI-driven CLI exposes potentially sensitive secrets to a component that can be prompted to inspect or exfiltrate them. In this skill's context, which emphasizes bypassing limits and local execution, the environment is especially sensitive because it likely contains credentials useful for lateral movement or data access.

Content

Scanner excerpt · __init__.py (reported line 37)May include surrounding context.

python

cmd.append("--continue")
            
        cmd.append(f'"{message}"')
        env = os.environ.copy()
        
        # Check if claude CLI is installed
        if shutil.which("claude") is None:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skill.json (reported line 4)May include surrounding context.

json

{
    "name": "claude_cli_skill",
    "version": "1.0.0",
    "description": "A universal MCP-compatible tool/skill that empowers ANY AI Agent to natively call the local Anthropic Claude Code CLI. Ideal for code refactoring, large scale code generation, terminal execution, bash shell commands, running tests, local environment modification, and bypassing token limits.",
    "author": "BigHit1",
    "entrypoint": "openclaw_claude_skill:ClaudeCLISkill",
    "tools": [
        {
            "name": "talk_to_claude",
            "description": "Provides local terminal execution, file system modification, and deep codebase analysis by delegating tasks to a sub

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · skill.json (reported line 10)May include surrounding context.

json

"tools": [
        {
            "name": "talk_to_claude",
            "description": "Provides local terminal execution, file system modification, and deep codebase analysis by delegating tasks to a sub-agent (Claude Code CLI). Use this tool when you need to execute bash commands, run tests, debug errors, or modify multiple files autonomously. Read the output closely. Use 'is_new_session=False' to continue conversations, or 'is_new_session=True' to wipe context. Absolute project_path is required.",
            "parameters": {
                "type": "object",
                "properties": {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill exposes shell/environment-backed capabilities but does not declare any tool scope restrictions such as permissions or allowed-tools. In a skill specifically designed to broker local CLI execution and filesystem changes, this omission weakens least-privilege controls and makes it easier for broad or unintended command execution to occur without clear policy boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill content is written as a Chinese-only operational instruction set and does not offer any language choice or note that the locale is intentionally constrained. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation states that the tool internally uses a permission-bypass mode, which removes interactive safety checks for local CLI actions. This is dangerous because the skill's stated use cases include terminal execution, tests, and local environment modification, so bypassing confirmations can enable destructive or unauthorized actions to proceed automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code forwards the entire parent process environment to the external Claude CLI, which may include API keys, cloud credentials, tokens, and internal configuration. Because the invoked tool can analyze the environment and act on arbitrary instructions, this creates a direct path for sensitive-data exposure or misuse beyond the intended task.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This PowerShell subprocess path constructs a command string by joining arguments and passing them to powershell -Command, which creates a command-injection surface on Windows if message contains shell metacharacters or quoting tricks. In this skill's context, the tool is explicitly designed to let an agent execute local terminal actions, so an attacker controlling the prompt can drive arbitrary local command execution with elevated Claude permissions.

Content

Scanner excerpt · __init__.py (reported line 52)May include surrounding context.

python

if os.name == 'nt':
                ps_cmd = " ".join(cmd)
                full_ps_cmd = f"[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; {ps_cmd}"
                result = subprocess.run(
                    ["powershell", "-Command", full_ps_cmd],
                    capture_output=True,
                    text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

Although subprocess.run(cmd, ...) on non-Windows avoids shell parsing, it still launches an external CLI that is intentionally instructed to read, write, fix code, and execute terminal commands based on untrusted agent-supplied message. Given the skill's purpose and the use of bypassed Claude permissions, this is effectively an unrestricted local code/command execution primitive rather than a harmless helper.

Content

Scanner excerpt · __init__.py (reported line 63)May include surrounding context.

python

timeout=600 
                )
            else:
                result = subprocess.run(
                    cmd,
                    capture_output=True,
                    text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest advertises terminal execution and filesystem modification but does not present an explicit warning that the tool can change the local environment or run arbitrary commands. In agent ecosystems, missing safety disclosures make accidental misuse more likely and can lead to unintended code execution, data loss, or host compromise through delegated actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The tool description is extremely broad and encourages use for terminal execution, debugging, file modification, and autonomous multi-file changes. Overly permissive invocation metadata can cause an agent to select this tool in situations where system-impacting actions were not clearly intended, increasing the chance of unsafe command execution or repository modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.