T09 · Insecure Skill Coding Practices
Error
- Location
scripts/bullybuddy.sh:43- Finding
JSON Injection into Security-Sensitive Session Spawn Requests
- Content
View full analysis
- Remediation
View remediation
Security audit
Bullybuddy
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Claude Code session manager, but it creates a high-impact control surface with weak token handling, broad persistent-session authority, and an unpinned executable dependency.
Review carefully before installing. Use this only if you intentionally want one token to control multiple Claude Code sessions. Keep the server local when possible, avoid --tunnel unless you need remote access, do not share or log /bullybuddy url output, rotate the token if it appears in logs or chat, avoid --dangerously-skip-permissions, and prefer a pinned/audited package version before using it on sensitive repositories.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bullybuddy.sh:109- Finding
Bearer Token Disclosure Through Credential-Bearing URLs
- Content
View full analysis
/dev/null) if [[ -n "$tunnel" ]]; then echo "Tunnel: $tunnel/?token=$BB_TOKEN" fi ;; ``` ### Technical Analysis The `url` command deliberately embeds the full bearer token in URL query parameters and writes those URLs to standard output. The token grants full control over all spawned Claude Code sessions, including access to transcripts and the ability to send arbitrary input. Secrets in query strings have a broad leakage surface. These URLs can be retained in: - Agent and tool execution transcripts - Terminal capture and command-output logs - Browser history and synchronization services - Proxy, gateway, tunnel, and web-server access logs - Screenshots, copied messages, and support records - Referrer headers when navigating from the dashboard to another resource The tunnel variant is especially sensitive because it exposes the control interface through a remotely accessible Cloudflare URL. Possession of the URL is sufficient to disclose the token to anyone who can read it. ### Attack Path 1. A user or agent invokes `/bullybuddy url`. 2. The script prints a local URL and, when configured, a public tunnel URL containing `BB_TOKEN`. 3. The output is stored in an agent transcript, log, terminal recording, browser history, or another observable location. 4. An unauthorized party retrieves the credential-bearing URL. 5. The party uses the token to authenticate to the dashboard, REST API, or WebSocket interface. 6. The party enumerates sessions, reads transcripts, sends terminal input, creates sessions, or terminates existing sessions. 7. Commands delivered through a controlled Claude Code session execute w ...[truncated 663 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:22- Finding
Unpinned Global npm Dependency Executes Unaudited Mutable Code
- Content
View full analysis
- Remediation
View remediation
``` Apply the following supply-chain controls: 1. Record and verify the package integrity digest or lockfile integrity metadata. 2. Audit and retain the source corresponding to the pinned release. 3. Review package lifecycle scripts and install with lifecycle scripts disabled where operationally possible. 4. Pin and audit transitive dependencies through a lockfile. 5. Avoid global installation; install into an isolated, least-privileged environment. 6. Monitor publisher ownership, release provenance, and unexpected version changes. 7. Use registry allowlists and package-signing or provenance verification where supported. 8. Re-audit the package before upgrading the pinned version. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The url command prints authenticated dashboard URLs with the bearer token embedded in the query string, directly exposing a reusable credential to the terminal, shell history, logs, screenshots, or chat transcripts. Query-string tokens are especially risky because they are often retained in browser history, copied unintentionally, and leaked through observability or referrer mechanisms.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This command is an explicit credential-disclosure capability: it reveals the authentication token verbatim as part of a URL. Anyone who sees the output can reuse the token to access the BullyBuddy service with the same privileges until the token is rotated or expires.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill invokes shell execution via
command-tool: execand an external script, but it does not declare anypermissionsorallowed-toolsscope. That leaves the skill with effectively broad execution capability while giving reviewers and users no explicit boundary on what tools or commands it may use.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The skill is explicitly designed to spawn, list, send input to, inspect, and kill multiple long-lived sessions, which creates a persistence and remote-control surface beyond a one-shot command. Persistent sessions increase exposure because they can retain context, continue operating after the initiating interaction, and be reused by anyone who gains control of the management interface.
- Content
text /bullybuddy status - Server status & session summary /bullybuddy list - List all sessions /bullybuddy spawn [cwd] [task] [group] - Create new session /bullybuddy send <id> <text> - Send input to session /bullybuddy output <id> [lines] - Show session output/transcript /bullybuddy kill <id> - Terminate session
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
This skill manages a service whose token grants full control over spawned Claude Code sessions, including arbitrary input delivery, and those sessions may run with local user permissions. In this context, unrestricted command-driving capability is dangerous because compromise of the token, dashboard URL, or wrapper flow can be turned into arbitrary actions in persistent agent sessions.
- Content
md - The auth token grants **full control over all spawned Claude Code sessions**, including sending arbitrary input. Treat it as a secret. - The `/bullybuddy url` command outputs the dashboard URL with the token embedded. Do not share or log this URL publicly. - When using `--tunnel`, the dashboard and API are exposed to the internet via a Cloudflare temporary URL. Anyone with the token can access all sessions remotely. - Spawned sessions run Claude Code with your local permissions. If `--dangerously-skip-permissions` is enabled, Claude can execute any command without confirmation. ## Authentication
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 84% confidence
- Finding
The documented
--dangerously-skip-permissionsmode allows Claude to execute commands without confirmation, removing an important human approval checkpoint. In a session-management skill that can spawn, steer, and remotely access multiple sessions, this materially increases the risk of unintended or malicious autonomous actions.- Content
md - The auth token grants **full control over all spawned Claude Code sessions**, including sending arbitrary input. Treat it as a secret. - The `/bullybuddy url` command outputs the dashboard URL with the token embedded. Do not share or log this URL publicly. - When using `--tunnel`, the dashboard and API are exposed to the internet via a Cloudflare temporary URL. Anyone with the token can access all sessions remotely. - Spawned sessions run Claude Code with your local permissions. If `--dangerously-skip-permissions` is enabled, Claude can execute any command without confirmation. ## Authentication
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The
--tunnelfeature exposes the dashboard and API over a Cloudflare temporary URL, enabling remote access to persistent sessions from the internet. Given that the token confers full control and may be embedded in the dashboard URL, this substantially raises the likelihood and impact of session hijacking or unauthorized remote operation.- Content
Remote Access
Start the server with
--tunnelto create a Cloudflare temporary URL automatically:bash bullybuddy server --tunnel
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh [[ -n "$task" ]] && body="${body},\"task\":\"$task\"" body="${body}}" result=$(curl -sf -X POST "$BB_URL/api/sessions" -H "$AUTH" -H "$CT" -d "$body") id=$(echo "$result" | jq -r '.data.id') echo "Spawned session: $id" echo "State: $(echo "$result" | jq -r '.data.detailedState')"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh exit 1 fi # Append carriage return for PTY curl -sf -X POST "$BB_URL/api/sessions/$id/input" -H "$AUTH" -H "$CT" -d "{\"data\":\"$text\\r\"}" > /dev/null echo "Sent to $id: $text" ;;
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The
killcommand issues an HTTP DELETE to remove a session and then reports success, but there is no confirmation prompt or prior warning before the destructive action. Because deleting a session may terminate active work irreversibly, users are not clearly alerted at the point of execution.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a CLI wrapper for spawning, listing, sending input to, killing, and monitoring Claude Code sessions. The
auditsubcommand adds access to a separate audit log capability, which is not mentioned in the described scope and goes beyond ordinary per-session management operations.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Printing a bearer token in a dashboard URL without warning creates a high likelihood of accidental credential leakage through terminal capture, clipboard history, logs, screenshots, or browser history. Because bearer tokens are sufficient for access, disclosure equates to account or service compromise for the token's scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The wrapper auto-discovers and loads
BB_TOKENfrom~/.bullybuddy/connection.json, which is credential access, but the script provides no visible notice to the user when doing so. Although this may be convenient, the absence of disclosure can obscure that sensitive credentials are being read automatically from disk.- Content