Security audit

OpenClaw CLAUDE BRIDGE

Security checks for vulnerabilities and agentic risk

Overview

This is a plausible Claude Code bridge, but it gives broad local file-editing and shell authority and ships old task scripts that can modify unrelated local projects.

Install only after reviewing and deleting the bundled tasks/results, and run it in a sandbox or disposable workspace. Treat any execution as granting Claude Code local file read, file edit, and shell-command capability under your logged-in Claude Code session, and avoid putting secrets or private code in prompts unless you have verified where your local Claude Code configuration sends data.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documentation advertises and demonstrates file read, file write, and shell execution capabilities, but does not declare corresponding permissions. This creates a transparency and governance gap: users and any permission-enforcement layer may underestimate what the skill can do, increasing the chance of unsafe execution in a local environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior goes far beyond a simple 'bridge' and includes persistent task/result storage, dynamic shell script generation, local execution, and the ability to direct Claude to read or modify arbitrary files. In context, this is dangerous because users may trust the benign description while the implementation enables broad local code execution and file access, which could be abused for unauthorized changes, data exposure, or execution of harmful commands.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The bridge grants the downstream Claude CLI the Bash tool, which enables arbitrary shell command execution from prompts passed through this skill. In a local bridge context, that materially expands risk from simple text processing to filesystem access, command execution, and potential data exfiltration on the host machine.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The task directs the agent to recursively analyze a local source tree and produce a detailed architectural report, which materially exceeds the declared skill purpose of merely bridging to a local Claude Code CLI. This expands the skill into local codebase auditing and data extraction, increasing the chance of unauthorized inspection of proprietary source code and persistence of sensitive findings into a markdown file.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Comparative architecture review of a local codebase is a distinct high-scope capability not justified by the stated bridge function. In practice, this enables the skill to be used as a local reconnaissance and intellectual-property analysis tool against arbitrary repositories accessible on disk.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is described as a bridge to the local Claude Code CLI, but this task is actually a pre-scripted repository analysis workflow targeting a separate local source tree and writing a report to disk. That scope mismatch is security-relevant because it can cause users to authorize a skill expecting simple CLI bridging while it performs broader file access and persistence operations on unrelated workspace content.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script grants the Claude session Read, Edit, and Bash permissions even though the stated purpose is only to bridge to the local Claude Code CLI. Excessive tool permissions enlarge the blast radius: the model can modify files and execute shell commands in the user's environment, including against the analyzed repository or other accessible workspace paths.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The task instructs the skill to open, modify, and save a local file in another skill directory under the user's home workspace. That exceeds a narrow 'bridge to local Claude Code CLI' purpose and creates a capability for cross-project file manipulation, which can be abused to alter arbitrary local code if task inputs are not tightly constrained.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script modifies a file in a different skill directory (`a-stock-monitor`) even though this skill is described as a bridge to a local Claude CLI. That cross-skill write behavior creates an unexpected trust boundary violation: invoking this skill can silently alter unrelated source code outside its own workspace and beyond the user's likely expectations.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Granting `Edit` and especially `Bash` to the downstream Claude invocation gives the task both source-modification and shell-execution capability, which is broader than needed for a narrowly described bridge skill. If abused or prompted unexpectedly, this can lead to arbitrary file changes or command execution under the user's local privileges.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The task explicitly instructs the agent to edit a source file belonging to a different skill (`kairos-mode`), which exceeds the declared purpose of this skill as a bridge to the local Claude Code CLI. Cross-skill source modification creates a capability for unauthorized tampering and lateral impact across the local workspace, especially when the task is packaged as routine maintenance.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The prompt grants direct local file read/modify/save authority over an arbitrary absolute path without demonstrating why that access is necessary for a simple CLI bridge. This broad filesystem write capability can be repurposed to alter code, configs, or data on the host, making the bridge a vehicle for unintended local compromise.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script is packaged under a skill described as a bridge to a local Claude CLI, but it instructs Claude to edit a source file in a different skill directory. That cross-skill modification violates expected scope boundaries and creates a confused-deputy risk where invoking one skill can silently alter unrelated code.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The command grants Claude both Edit and Bash capabilities even though the stated purpose is only to bridge to a local CLI for a specific code fix. Excessive tool permissions increase the blast radius of prompt injection, operator error, or model misuse, enabling arbitrary file changes or shell execution beyond the minimal task.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The task instructs the skill to read, modify, and save a local source file in another skill's directory, which exceeds a narrowly described 'bridge to local Claude Code CLI' purpose. This creates cross-skill file modification capability that could be abused to alter arbitrary local code if similar tasks are accepted without tighter scope controls.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The prompt grants broad local code-editing behavior unrelated to the stated bridge function, effectively turning the skill into a general-purpose source editor. In context, that mismatch is dangerous because a bridging skill with unconstrained edit authority can be used to silently change local codebases, persistence logic, or security-sensitive files.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script invokes Claude to read and modify a source file in a different skill directory (`agent-memory`) rather than operating only within the declared bridge skill workspace. That creates a cross-workspace write capability that can unexpectedly alter unrelated code, increasing the risk of unauthorized changes or supply-chain style tampering if the task is triggered without strict scope validation.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script invokes the local Claude CLI with Read, Edit, and Bash permissions and directs it to modify files in a separate source tree and run commands to validate the result. That is materially broader than a simple bridge to a local CLI and creates a powerful delegated execution path that can alter arbitrary local project files and execute shell commands with the user's privileges.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The workflow tells the agent it has complete filesystem access and instructs it to repair a Web UI by editing files and running shell commands, including starting a server for verification. In the context of a skill described only as a bridge to local Claude Code CLI, this is an unjustified privilege expansion and could be abused to make unintended local changes or execute harmful commands.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The task directs the skill to inspect and analyze code under ~/.openclaw/workspace/ and produce an architecture-diff report, which is materially different from the declared purpose of a simple bridge to a local Claude Code CLI. This mismatch expands the skill into local codebase reconnaissance and reporting, creating an unjustified access path to potentially sensitive proprietary source code.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Requesting inspection of a local workspace and extraction of architecture differences is not justified by a bridge skill and grants broader analytical access to local files than the skill description suggests. Even without explicit exfiltration, this enables sensitive code discovery, summarization, and potential leakage through generated reports.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill metadata says it is a bridge to a local Claude Code CLI, but this script embeds and executes a specific task that inspects the user's local workspace and writes a report. That mismatch is dangerous because it expands the skill from a generic bridge into undisclosed local analysis of user files, increasing the chance of unintended data access and deceptive behavior.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script launches Claude with Read, Edit, and Bash permissions even though the stated skill purpose is only to bridge to a local CLI. Granting edit and shell capabilities to a hard-coded task against the user's workspace creates unnecessary authority that could modify files or execute commands locally if the invoked agent behaves unexpectedly or is influenced by prompt content.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The generated shell script interpolates untrusted prompt text directly into a Bash command line, escaping only double quotes and not shell metacharacters such as command substitution syntax. An attacker-controlled prompt containing constructs like $(...) or backticks can execute arbitrary commands when the script runs, and the enabled Bash tool further amplifies the impact.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The task prompt is effectively a broad operational instruction with no documented trigger constraints, safety boundaries, or exclusions on what local content may be inspected. Unconstrained prompts increase the risk of overbroad activation and misuse, especially in a skill with filesystem reach and report-writing behavior.

Static analysis

No suspicious patterns detected.