T01 · Skill Instruction Hijacking
Error
- Location
agents-section.md:10- Finding
Delegated Agent Runs with Permission Enforcement Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
Claude Dev Setup
Security checks for vulnerabilities and agentic risk
Overview
This skill openly sets up Claude Code automation, but it teaches agents to expose local OAuth tokens and bypass normal permission checks.
Review before installing. Do not use this skill as written on a machine with real Claude credentials or sensitive repositories unless you remove raw token extraction, remove shell-profile token loading, avoid --dangerously-skip-permissions, and run delegated agents in a constrained environment with explicit approval for sensitive actions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:68- Finding
OAuth Token Is Explicitly Extracted into Commands and Tool Output
- Content
View full analysis
/dev/null | grep -o '"accessToken":"[^"]*"' | cut -d'"' -f4) ``` ### Technical Analysis The documented workflow explicitly reads `~/.claude/.credentials.json`, extracts the OAuth access token, and places it into command environments. One recommended `exec` operation prints the extracted token as command output, making it available to tool transcripts, logs, session histories, or monitoring systems. Embedding a secret directly in command text can also expose it through process metadata, debugging output, audit systems, or error reports. Loading the token into every interactive shell through a profile expands its lifetime and exposure to unrelated child processes. ### Attack Path 1. The agent follows the documented token-extraction workflow. 2. The `exec` tool returns the raw token in its output, or the token appears in a generated command or process environment. 3. Tool logs, transcripts, shell debugging, process inspection, or another local process captures the credential. 4. An attacker reuses the token before it expires or is revoked. 5. The attacker accesses Claude services or consumes resources associated with the victim's account, subject to the token's effective scope. ### Impact Assessment The exposed credential may ...[truncated 333 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
agents-section.md:33- Finding
Task Text Can Escape Shell Quoting and Execute Arbitrary Commands
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
setup.sh:14- Finding
Setup Installs an Unpinned Package Globally
- Content
View full analysis
/dev/null; then echo "⚠️ Claude Code CLI not found. Installing..." npm install -g @anthropic-ai/claude-code else ``` ### Technical Analysis The setup script installs the package without specifying a version or verifying package integrity. Consequently, the package version resolved at installation time can differ from the version reviewed or tested by the skill author. The global installation also broadens the effect of a compromised or unexpectedly changed package. npm packages can execute lifecycle scripts during installation, and a global package can place executables in a system-wide or user-wide command path. No evidence shows that the named package is malicious; the vulnerability is the unpinned, unverified installation process. ### Attack Path 1. The expected `claude` executable is absent. 2. A user runs `setup.sh`. 3. npm resolves the then-current release of `@anthropic-ai/claude-code`. 4. If the registry account, publication pipeline, package release, or registry resolution is compromised, npm downloads the affected package. 5. Package installation or lifecycle code executes with the privileges used to run the setup script. 6. The resulting global executable remains available to subsequent agent sessions. ### Impact Assessment A compromised dependency release could execute code during installation and replace or modify a globally available tool. The resulting privileges equal those of the user running npm and may be elevated if setup is executed with administrative privileges. The package can affect later Claude CLI invocations because it is installed globally. ]]>- Remediation
View remediation
`. 2. Verify the package against an expected integrity hash or trusted lockfile. 3. Review release signatures or provenance where supported. 4. Avoid global installation when possible; use an isolated, project-local dependency or controlled tool environment. 5. Disable npm lifecycle scripts with `--ignore-scripts` when compatible with the package's supported installation process. 6. Never instruct users to run the installer as root or through `sudo`. 7. Establish an explicit upgrade process that reviews and tests each new version before changing the pin. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (56)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill repeatedly instructs agents to extract a long-lived OAuth token from a local credentials file and reuse it in commands. That normalizes credential harvesting from agent-accessible storage and creates a path for unauthorized token exposure, replay, or leakage into logs, subprocesses, shell history, or downstream tools.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Disclosing the exact location of a long-lived credential file lowers the barrier for any downstream agent or user to target that secret store. In this skill, the disclosure is paired with repeated extraction instructions, making it more dangerous than a neutral reference.
- Content
Claude Code stores its OAuth token in:
text ~/.claude/.credentials.jsonToken Format
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 99% confidence
- Finding
This line instructs direct reading of ~/.claude/.credentials.json to extract an access token. Accessing agent config directories for secrets is dangerous because it turns local credential stores into consumable input for automation, increasing risk of exfiltration and misuse.
- Content
Option 1: Extract from credentials file (RECOMMENDED)
bash # Extract the accessToken from credentials cat ~/.claude/.credentials.json | grep -o '"accessToken":"[^"]*"' | cut -d'"' -f4Option 2: Authenticate via browser (first-time setup)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This command directly accesses and extracts the access token from the credentials file. It is a true credential-access issue because it turns a stored secret into command output, enabling theft, replay, or accidental disclosure.
- Content
Option 1: Extract from credentials file (RECOMMENDED)
bash # Extract the accessToken from credentials cat ~/.claude/.credentials.json | grep -o '"accessToken":"[^"]*"' | cut -d'"' -f4Option 2: Authenticate via browser (first-time setup)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation directs use of --dangerously-skip-permissions as the normal invocation pattern for Claude CLI calls. This bypasses interactive safeguards and approval boundaries, making it easier for automated tasks to perform sensitive actions without user review.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The examples repeatedly recommend --dangerously-skip-permissions but do not explain that it disables important safety and approval checks. Presenting unsafe flags as the standard workflow makes misuse more likely and lowers operator awareness of the security tradeoff.
- Content
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
This example routes tasks to an external model provider using an extracted OAuth token and an unsafe permissions-bypass flag. In combination, it can send user or repository data to an external service under unattended execution conditions, raising confidentiality and control risks.
- Content
bash # ✅ CORRECT - Token set explicitly export CLAUDE_CODE_OAUTH_TOKEN="sk-ant-oat01-xxxxx..." claude --print --dangerously-skip-permissions "your task" # ❌ WRONG - Token not set, will fail in non-interactive mode claude --print "your task"
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
claude --print --dangerously-skip-permissions "your task"
❌ WRONG - Token not set, will fail in non-interactive mode
claude --print "your task"
text ### Automatic Token Extraction
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 99% confidence
- Finding
This line persists automatic secret extraction in a shell profile, causing future sessions to load credentials implicitly. That expands the blast radius of any compromise and makes accidental leakage through child processes or environment inspection more likely.
- Content
Add to your shell profile for automatic token loading:
bash # Add to ~/.bashrc or ~/.zshrc export CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json 2>/dev/null | grep -o '"accessToken":"[^"]*"' | cut -d'"' -f4)For Agent Executors
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line installs persistent credential extraction into shell startup files, making secret loading automatic for all future shells. That increases long-term exposure and creates many opportunities for unintended propagation of the token.
- Content
Add to your shell profile for automatic token loading:
bash # Add to ~/.bashrc or ~/.zshrc export CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json 2>/dev/null | grep -o '"accessToken":"[^"]*"' | cut -d'"' -f4)For Agent Executors
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 99% confidence
- Finding
This example embeds credential extraction directly into an exec command string for background execution. Secrets passed this way may be exposed to logs, process listings, task history, or other observability surfaces, while also normalizing unauthorized config-directory access.
- Content
json exec({ command: "export CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json | grep -o '\"accessToken\":\"[^\"]*\"' | cut -d'\"' -f4) && claude --print --dangerously-skip-permissions 'Task description'", background: true, yieldMs: 10000 })
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This exec example accesses the credential file and exports the token inside a command string. Secret material handled this way may be exposed via logs, process inspection, or tool telemetry, making it a high-risk credential access pattern.
- Content
json exec({ command: "export CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json | grep -o '\"accessToken\":\"[^\"]*\"' | cut -d'\"' -f4) && claude --print --dangerously-skip-permissions 'Task description'", background: true, yieldMs: 10000 })
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 99% confidence
- Finding
This instruction explicitly runs a command whose sole purpose is to extract and output the token from the credentials file. Printing or returning a secret is a direct exposure risk and is unnecessary in a secure automation design.
- Content
json // First, extract token exec({ command: "cat ~/.claude/.credentials.json | grep -o '\"accessToken\":\"[^\"]*\"' | cut -d'\"' -f4" }) // Then use in all subsequent calls
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The instruction explicitly tells the agent to extract the token first as a separate command, meaning the credential may be returned in plain output. This is a direct and unnecessary exposure of authentication material.
- Content
json // First, extract token exec({ command: "cat ~/.claude/.credentials.json | grep -o '\"accessToken\":\"[^\"]*\"' | cut -d'\"' -f4" }) // Then use in all subsequent calls
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 99% confidence
- Finding
This background-task pattern again reads the local credentials file and injects the token inline into a command. The combination of secret access plus unattended execution increases the chance of silent misuse and harder-to-detect credential exposure.
- Content
md // Step 1: Extract token from credentials // Step 2: Use in Claude Code call exec({ command: "CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json | grep -o '\"accessToken\":\"[^\"]*\"' | cut -d'\"' -f4) claude --print --dangerously-skip-permissions 'Task description'", background: true, yieldMs: 10000 })
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This command accesses the credentials file to authenticate a background task. It combines direct credential access with unattended execution, increasing both exposure and abuse potential.
- Content
md // Step 1: Extract token from credentials // Step 2: Use in Claude Code call exec({ command: "CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json | grep -o '\"accessToken\":\"[^\"]*\"' | cut -d'\"' -f4) claude --print --dangerously-skip-permissions 'Task description'", background: true, yieldMs: 10000 })
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 99% confidence
- Finding
Even for quick tasks, the skill mandates reading the credential store and using the token inline. Repeating this as a convenience pattern broadens routine secret handling and raises the likelihood of leakage in ordinary operations.
- Content
For simple tasks, use direct exec without tracking:
json exec({ command: "CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json | grep -o '\"accessToken\":\"[^\"]*\"' | cut -d'\"' -f4) claude --print --dangerously-skip-permissions 'Quick fix'", timeout: 60 })
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This quick-task example repeats the same credential-scraping pattern, which encourages widespread routine access to secrets. Frequent repetition of unsafe secret handling increases the probability of compromise.
- Content
For simple tasks, use direct exec without tracking:
json exec({ command: "CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json | grep -o '\"accessToken\":\"[^\"]*\"' | cut -d'\"' -f4) claude --print --dangerously-skip-permissions 'Quick fix'", timeout: 60 })
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Declaring the token location as a required part of agent guidance increases discoverability of a sensitive secret store. In this file's context, that contributes to a broader unsafe credential-handling workflow.
- Content
OAuth Token (Required)
Token location:
~/.claude/.credentials.jsonALWAYS extract and use the token:
bash
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 99% confidence
- Finding
The AGENTS.md integration propagates credential-file access guidance into broader agent workflows. That institutionalizes sensitive config-directory access across projects, increasing systemic risk beyond this single skill.
- Content
ALWAYS extract and use the token:
bash CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json | grep -o '"accessToken":"[^"]*"' | cut -d'"' -f4) claude --print --dangerously-skip-permissions 'task'Session Tracking
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line mandates extracting and using the token from the credentials file for all tasks. That is a direct credential-access instruction that can lead to exposure, misuse, and systemic secret handling by agents.
- Content
ALWAYS extract and use the token:
bash CLAUDE_CODE_OAUTH_TOKEN=$(cat ~/.claude/.credentials.json | grep -o '"accessToken":"[^"]*"' | cut -d'"' -f4) claude --print --dangerously-skip-permissions 'task'Session Tracking
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Logging session IDs, labels, and task descriptions into a persistent markdown file can leak sensitive project context, user intent, or operational metadata. In an agent environment, such context can later be read by other tools or accidentally committed, broadening exposure.
- Content
md All background sessions tracked in `memory/claude-code-sessions.md`. **Before starting:** Check for running sessions **After starting:** Log session ID + label **On completion:** Update status column ### When User Asks Status
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 98% confidence
- Finding
The workflow diagram includes extracting the token from ~/.claude/.credentials.json as a standard operational step. Embedding that into the canonical workflow normalizes secret access as expected behavior and increases the chance of abuse by downstream agents or operators.
- Content
md ↓ Agent reads memory/claude-code-sessions.md (check for conflicts) ↓ Agent extracts token: cat ~/.claude/.credentials.json | grep accessToken ↓ Agent starts: exec({ command: "CLAUDE_CODE_OAUTH_TOKEN=xxx claude ...", background: true }) ↓
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The workflow explicitly includes extracting the token from the credentials file as a standard step. That embeds secret access into routine operations and makes abuse more likely across repeated use.
- Content
md ↓ Agent reads memory/claude-code-sessions.md (check for conflicts) ↓ Agent extracts token: cat ~/.claude/.credentials.json | grep accessToken ↓ Agent starts: exec({ command: "CLAUDE_CODE_OAUTH_TOKEN=xxx claude ...", background: true }) ↓
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 97% confidence
- Finding
This checklist item tells users to verify token extractability from the credentials file, reinforcing that local secret access is acceptable. While less directly exploitive than command examples, it still trains operators and agents to treat credential scraping as routine.
- Content
md - [ ] Claude Code CLI installed: `which claude` - [ ] Authenticated: check `~/.claude/.credentials.json` exists - [ ] Token extractable: `cat ~/.claude/.credentials.json | grep accessToken` - [ ] Session file created: `memory/claude-code-sessions.md` - [ ] AGENTS.md updated with session section - [ ] APEX Stack added to project CLAUDE.md (if applicable)
Static analysis
No suspicious patterns detected.