ClawHub
Back to skill

Security audit

Dispatchi (Ralph Loop)

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its dispatcher purpose, but it should be reviewed because it starts background Claude sessions while auto-accepting safety prompts and using weakly validated user-controlled paths and prompts.

Install only if you are comfortable with a skill that starts background Claude Code sessions in local repositories. Use simple safe project and task names, avoid bypassPermissions or broad permission modes, keep callbacks disabled unless needed, and prefer a version that validates paths, fixes shell quoting, and stops auto-accepting Claude safety prompts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
claude_parts += args.extra

    launch = f"cd {shlex.quote(cwd)} && " + " ".join(shlex.quote(p) for p in claude_parts)
    subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", launch))
    subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"))

    # Workspace trust prompt (first run in a new folder).
Confidence
94% confidence
Finding
This sends a constructed shell command into an interactive tmux shell, where it will be interpreted by the shell inside the pane. Although cwd and claude arguments are shell-quoted, this still launches a powerful external CLI with user-controlled flags such as --append-system-prompt, --system-prompt, --allowedTools, and extra args, which can weaken safety boundaries and trigger dangerous downstream actions in an agent-execution context.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Workspace trust prompt (first run in a new folder).
    if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=20):
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
        if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=2):
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)
Confidence
97% confidence
Finding
The wrapper auto-accepts a workspace trust prompt by sending Enter when it detects 'Yes, I trust this folder'. Automatically trusting a workspace removes an intended security checkpoint and can expose the agent to untrusted repository instructions, hooks, and local context without explicit operator review.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# If we send task text before accepting this prompt, it can accidentally choose the default "No, exit".
    if tmux_wait_for_text(socket_path, target, "Yes, I accept", timeout_s=10):
        # Select option 2 and confirm.
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "2"), check=False)
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
Confidence
99% confidence
Finding
This line programmatically selects acceptance of the bypass-permissions warning, effectively suppressing a safeguard designed to prevent unrestricted tool execution. In an agent skill, that materially increases the chance of unauthorized file/system actions if prompts or tool settings are attacker-influenced.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
        if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=2):
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)

    # Bypass Permissions warning prompt (when running with --permission-mode bypassPermissions).
Confidence
97% confidence
Finding
If the trust prompt persists, this line explicitly selects option 1 to trust the folder. That intentionally bypasses a human trust decision and can cause the agent to operate inside an untrusted workspace with elevated confidence in local instructions and tooling.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if args.prompt:
        for line in [ln for ln in args.prompt.splitlines() if ln.strip()]:
            subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", line))
            subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"))
            time.sleep(args.interactive_send_delay_ms / 1000.0)
Confidence
93% confidence
Finding
User-controlled prompt lines are injected as keystrokes into an interactive Claude session. In this skill's context, slash commands are explicitly treated as a feature, so untrusted prompt content can drive privileged interactive actions, tool use, or session state changes in a way that bypasses safer headless argument handling.

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.check_call (code execution)

Medium
Category
Data Flow
Content
claude_parts += args.extra

    launch = f"cd {shlex.quote(cwd)} && " + " ".join(shlex.quote(p) for p in claude_parts)
    subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", launch))
    subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"))

    # Workspace trust prompt (first run in a new folder).
Confidence
95% confidence
Finding
Here the environment-derived socket_path identifies the tmux server receiving a synthesized shell command. If an attacker can influence the socket path or attach to a malicious/shared tmux server, they may redirect commands into an unintended session or interact with a server under their control, compounding the risk of the shell command launched in the pane.

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
# Workspace trust prompt (first run in a new folder).
    if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=20):
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
        if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=2):
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)
Confidence
97% confidence
Finding
Using an environment-influenced tmux socket plus automatic trust acceptance means the script may send trust-confirmation keystrokes to an unintended/shared tmux server. In the intended server, it also suppresses an important safety gate for untrusted workspaces.

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
# If we send task text before accepting this prompt, it can accidentally choose the default "No, exit".
    if tmux_wait_for_text(socket_path, target, "Yes, I accept", timeout_s=10):
        # Select option 2 and confirm.
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "2"), check=False)
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
Confidence
98% confidence
Finding
This combines two problems: environment-controlled tmux targeting and automatic acceptance of the bypass-permissions warning. In the worst case, the wrapper sends privileged approval keystrokes to a server/session selected via untrusted state, while also disabling Claude's permission protections.

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
        if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=2):
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)

    # Bypass Permissions warning prompt (when running with --permission-mode bypassPermissions).
Confidence
97% confidence
Finding
Selecting trust option 1 on a tmux server chosen through environment-derived socket state can affect an unintended or shared session, and in the intended session it bypasses a user trust decision. That weakens workspace isolation in exactly the interactive context this wrapper is designed to automate.

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.check_call (code execution)

Medium
Category
Data Flow
Content
if args.prompt:
        for line in [ln for ln in args.prompt.splitlines() if ln.strip()]:
            subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", line))
            subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"))
            time.sleep(args.interactive_send_delay_ms / 1000.0)
Confidence
95% confidence
Finding
User-controlled prompt lines are delivered into whichever tmux server/socket is selected, including one influenced by environment state. In this skill's context, those lines may contain slash commands intended to drive interactive agent behavior, making the combination of untrusted socket selection and untrusted prompt injection particularly dangerous.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares that it runs a local shell script with user-supplied arguments and uses environment-driven configuration, but it does not declare permissions for shell or environment access. That mismatch reduces transparency and weakens policy enforcement, making it easier for a caller to invoke filesystem, tmux, and process-launch capabilities without an explicit permission boundary.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.