Claude Code Delegate

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:53 AM UTC
• Version: 0.1.1

Overview

The skill is not clearly malicious, but it automatically delegates broad coding tasks to a local AI process with full file access, so it needs careful review before use.

Install only if you are comfortable with a local delegated AI editing files. Use an isolated project directory, avoid repositories containing secrets, prefer explicit `/code` invocation or confirmation before delegation, do not rely on the sample write guard as a sandbox, and pin or verify external package installs where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:10

Finding

Session-Wide Agent Behavior and Instruction Hijacking

Content

View full analysis

` Do NOT trigger: chat, emotional interaction, information lookup. ``` ```markdown ### Rules 1. After `exec claude -p`, you MUST reply to user and END your turn. No more tool calls. 2. NEVER use `process` tool directly. Use `exec "process poll --timeout 1000"` on next user message. 3. Only check the delegate's status when the user sends a NEW message. 4. You can run multiple `claude -p` tasks in parallel. ``` ```markdown ## Failure Rule **If the delegate fails or times out, do NOT write code yourself.** Tell the user: "The coding task didn't finish. Want me to try again?" Retry with longer timeout or simpler task description. Only write code yourself if user explicitly says "you do it" (not recommended). ``` ### Technical Analysis The Skill uses absolute directives such as `NEVER`, `MUST`, and `do NOT` to replace the host Agent's normal tool-selection, coding, error-recovery, and turn-management behavior. The directives apply automatically to a broad range of activities, including planning, review, testing, and nearly every file edit. This is not limited to an explicitly invoked delegation operation. Loading the Skill can cause ordinary technical requests to be redirected to an external CLI process and can prevent the host Agent from using safer local alternatives. Mandatory turn termination and delayed polling also alter the Agent's interaction flo ...[truncated 1119 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:38

Finding

Delegated Process Receives Unrestricted Filesystem and Command Permissions

Content

View full analysis

" && claude -p "" --output-format text --max-turns 10 --permission-mode bypassPermissions ``` ```markdown | `--permission-mode bypassPermissions` | Auto-accept file edits (**requires write-guard**, see Prerequisites) | Recommended | ``` ```markdown 1. **Always use an isolated project directory** — Never run the delegate against your home directory, system config, or repositories containing secrets. Use a dedicated `projects/` or `workplace/` directory. 2. **Set up the write-guard plugin** — This is the most important safety measure. See README.md for the full plugin code. The write-guard blocks writes to platform config files (`.openclaw/`, `LaunchAgents/`, auth profiles) at the platform level. 3. **Never use `--dangerously-skip-permissions`** — This flag is explicitly forbidden. `--permission-mode bypassPermissions` is the correct flag and works with the write-guard. 4. **Restrict to project scope** — The `cd "" &&` prefix ensures the delegate operates within the intended directory. Never omit it. ``` The README also explicitly describes the effective permission level: ```markdown This skill uses `--permission-mode bypassPermissions` which grants the delegate full filesystem access. Without a write-guard, the delegate can read/write any file on the system. ``` ### Technical Analysis The Skill recommends `--permission-mode bypassPermissions`, which automatically approves operations performed by the delegated Claude CLI. The documentation acknowledges that this grants full filesystem access. Changing the shell's current working directory with `cd` is not a security boundary. A process can still use absolute paths, parent-directory traversal, symlinks, ...[truncated 1875 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:38

Finding

Shell Command Injection Through Interpolated Project Paths and Task Descriptions

Content

View full analysis

" && claude -p "" --output-format text --max-turns 10 --permission-mode bypassPermissions ``` The multiline README template contains the same interpolation pattern: ```bash cd "" && claude -p "" \ --output-format text \ --max-turns 10 \ --permission-mode bypassPermissions ``` ### Technical Analysis The command template inserts `project_dir` and `task_description` directly into shell command text. Double-quoting is not a complete defense when values are constructed by string replacement and passed to a shell. Depending on how the host implements the template, hostile values can introduce: - Embedded quote characters that terminate the intended argument. - Command substitutions such as `$(...)` or backticks. - Shell operators such as `;`, `&&`, `||`, pipes, or redirections after escaping the quoted context. - Newline-based command separation. - Option injection or malformed path handling. The Skill provides no escaping algorithm, path validation, canonicalization, argument-array execution requirement, or rejection policy for shell metacharacters. ### Attack Path 1. An attacker controls or influences the requested task text, project path, issue description, repository metadata, or another value copied into the template. 2. The Agent substitutes the untrusted value into the command string. 3. The generated command is passed to a shell through `exec`. 4. Shell syntax embedded in the value is interpreted before `claude` receives the intended argument. 5. The injected command executes with the same operating-system privileges and environment as the Agent. A malicious task description could, for example, close the quoted argument and append an additional shell command. Command substitution can also b ...[truncated 563 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:96

Finding

Documented Write Guard Is Incomplete and Bypassable

Content

View full analysis

{ if (['write', 'edit', 'apply_patch'].includes(event.toolName)) { const path = event.params.path ?? event.params.file_path ?? ''; for (const blocked of BLOCKED_PATHS) { if (path.includes(blocked)) { return { block: true, blockReason: `BLOCKED: Cannot write to ${path}. Platform config files are protected.`, }; } } } }); ``` ### Technical Analysis The guard only examines three named tool operations: `write`, `edit`, and `apply_patch`. It does not inspect or block mutations performed through shell commands, scripts, interpreters, package managers, alternate filesystem APIs, renamed tools, or child processes. Path protection is implemented using non-canonical substring matching. This does not establish that the resolved target is outside an allowed root and does not reliably address: - Symbolic or hard links. - Relative paths and `..` traversal. - Path normalization and case-sensitivity differences. - Alternate filesystem namespaces. - Writes through an allowed path that resolves to a blocked target. - Sensitive paths not present in `BLOCKED_PATHS`. The guard also focuses on writes. It does not prevent the delegated process from reading authentication profiles, API keys, Agent configuration, source repositories, or other secrets. ### Attack Path 1. The write-guard plugin is installed and treated as the primary safety control. 2. The delegate is launched with permission bypass enabled. 3. The delegated process uses a shell command, script, alternate tool, or package lifecycle hook instead of one of the three intercepted tools. 4. A ...[truncated 823 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:28

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute npx clawhub install claude-code-delegate without pinning a specific package version. This creates a supply-chain risk because installation behavior can change over time or a compromised/latest package could be fetched and executed implicitly on the user's system.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 55% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

md

| `--output-format text` | Plain text output for easy parsing |
| `--max-turns 10` | Limit execution rounds (adjust as needed) |
| `--permission-mode bypassPermissions` | Auto-accept file operations (see Security Notes) |
| `--continue` | Resume previous session (for debugging/iteration) |

## Key Features

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The README explicitly endorses running Claude Code with --permission-mode bypassPermissions, granting broad filesystem access, while only recommending a write-guard as an external safeguard. This is dangerous because the skill's default operating model enables unrestricted file access and relies on users to correctly add compensating controls that may be absent or incomplete.

Content

Scanner excerpt · README.md (reported line 99)May include surrounding context.

md

### CRITICAL: Protect Platform Config Files

When using `--permission-mode bypassPermissions`, Claude Code can read and write any file. You **must** set up a write-guard to protect sensitive paths.

**Recommended: Create a `before_tool_call` plugin** that blocks writes to:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is configured to auto-trigger on extremely broad software-related intents such as writing, debugging, reviewing, testing, planning, and nearly any file edit. In this skill, triggering launches a delegated CLI workflow that ultimately runs claude -p with --permission-mode bypassPermissions, so ordinary conversation about code can unexpectedly escalate into autonomous filesystem-modifying behavior without sufficiently explicit user consent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

Allowing --continue resumes prior Claude Code session state, which can carry forward unreviewed context, prior instructions, and assumptions into later tasks. In a skill that also recommends bypassPermissions, session reuse increases the chance of unintended actions, context poisoning, or applying stale task context to the wrong project or user request.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

| `--output-format text` | Plain text output | Recommended |
| `--max-turns 10` | Limit execution rounds | Recommended |
| `--permission-mode bypassPermissions` | Auto-accept file edits (**requires write-guard**, see Prerequisites) | Recommended |
| `--continue` | Resume previous session (for debugging/iteration) | When fixing bugs in same project |

**FORBIDDEN: `--dangerously-skip-permissions`**

Static analysis

No suspicious patterns detected.