Security audit

Service Persistence

Security checks across malware telemetry and agentic risk

Overview

This skill is openly for keeping macOS services running, but it also includes an always-on Claude Telegram wrapper that bypasses safety prompts and auto-confirms trust decisions.

Review carefully before installing. Only use it if you intentionally want login-time and crash-recovery persistence. Replace the hardcoded paths and service list, remove Claude permission-bypass flags, do not auto-approve trust prompts, bind dev servers to localhost unless remote access is required, and inspect every LaunchAgent before loading it. VirusTotal was pending and the static scan was clean; the Review verdict is based on the artifact behavior itself.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script launches Claude with `--dangerously-skip-permissions --permission-mode bypassPermissions`, which disables normal permission gating and grants the agent broader authority than is required for simple service persistence. In a persistence wrapper that automatically restarts on boot, this creates a continuously running privileged automation path that could execute sensitive actions without user approval if the agent is misused, compromised, or prompted unsafely.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script captures tmux output and automatically presses Enter when it detects a "trust this folder" prompt, bypassing an interactive safety decision that is meant to require user intent. Automating trust establishment in a restart loop weakens a protection boundary and can silently re-enable access to a workspace after reboot or after configuration changes.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document instructs users to deploy scripts into LaunchAgents, enable RunAtLoad/KeepAlive behaviors, and maintain auto-start persistence without an explicit warning that this changes login/startup behavior and system state. In a persistence-focused skill, the absence of an upfront warning increases the chance of unintended durable changes that are difficult for users to notice or roll back.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script automatically starts several long-running services at boot, including development servers bound to 0.0.0.0, which exposes them on all network interfaces without any interactive approval or environment gating. In a persistence-focused skill, this increases risk because the behavior is designed to survive reboot, making accidental exposure durable and easy to forget.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The combination of launching Claude with permission bypass flags and auto-confirming the trust prompt creates an unattended service that suppresses both permission checks and interactive trust validation. In the context of a persistence skill whose purpose is to survive reboot and auto-recover services, this is more dangerous because it makes the unsafe configuration durable, automatic, and likely to run without the user noticing.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.