Security audit

Auto Reboot Recovery

Security checks for vulnerabilities and agentic risk

Overview

This is a real reboot-recovery skill, but it can keep an unattended Telegram-connected Claude agent running with permission checks bypassed.

Review carefully before installing. Edit out hard-coded personal paths and services, bind dev servers to localhost unless exposure is intentional, remove Claude permission-bypass flags, do not auto-confirm trust prompts, restrict Telegram access, and verify how to unload any LaunchAgents created by the skill.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The bootstrap script for reboot recovery also starts several unrelated developer application servers and background jobs, which expands the persistence scope well beyond infrastructure recovery. In a persistence-oriented skill, this is risky because any use of the script on login/reboot will automatically re-enable multiple services, increasing attack surface and making unintended long-running exposure more likely.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script launches development servers bound to 0.0.0.0, making them reachable on all network interfaces after reboot. Development servers often lack hardening, authentication, and production-safe defaults, so auto-starting them as part of persistence/recovery can unintentionally expose internal apps to the local network or beyond.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The wrapper launches Claude with `--dangerously-skip-permissions --permission-mode bypassPermissions`, which disables safety and approval boundaries for an automatically restarted long-running agent. In a persistence/reboot-recovery skill, this is especially dangerous because the script ensures the agent comes back unattended after reboot, increasing the chance of unauthorized filesystem, command, or network actions without human review.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The script inspects pane output for a 'trust this folder' prompt and automatically sends Enter to confirm it. Auto-approving trust or confirmation prompts bypasses an interactive security decision and can silently grant elevated trust to code, workspaces, or tooling state after reboot, especially dangerous in a persistence-oriented skill that restarts services unattended.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script detects a "trust this folder" prompt and automatically presses Enter, silently granting trust without user awareness. That removes an important safety checkpoint and can cause the agent to operate in a directory the user has not explicitly reviewed or approved, which is more concerning in an auto-restart script designed to recover unattended sessions after reboot.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script invokes Claude with dangerous permission-bypass flags and provides no in-file warning, guardrail, or justification for this elevated mode. Because this is a recovery/persistence wrapper, the risky configuration is not a one-off interactive choice but a durable unattended behavior that can repeatedly restart an over-privileged agent.

Static analysis

No suspicious patterns detected.