Claude Code Dispatch

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:57 AM UTC
• Version: 1.0.0

Overview

This skill is a clearly disclosed bridge to run Claude Code on local coding tasks, but users should treat it as a powerful delegation tool that can expose project data and local environment secrets to Claude Code.

Install this only if you intentionally want an OpenClaw agent to hand coding tasks to your authenticated Claude Code CLI. Use the narrowest --tools preset that works, prefer read-only mode for review, avoid passing secrets in prompts, and run from an environment with only the credentials needed for the task. Pin or separately manage the Claude Code dependency if reproducible installs matter to you.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Claude Code npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Complete Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["claude","jq"]},"install":[{"id":"claude","kind":"npm","package":"@anthropic-ai/claude-code","bins":["claude"],"label":"Install Claude Code (npm)"},{"id":"jq","kind":"brew","formula":"jq","bins":["jq"],"label":"Install jq (brew)"}]}}

Technical Analysis

The installation metadata references @anthropic-ai/claude-code without an exact version or integrity hash. Consequently, installation may resolve whichever package release the registry serves at that time rather than the release reviewed with this Skill.

Although the package name uses Anthropic's expected npm scope and no malicious package behavior is demonstrated in the audited files, the absence of version and integrity pinning creates supply-chain exposure. A compromised publisher account, registry response, or future malicious release could cause unreviewed executable code to be installed.

Attack Path

1. An attacker compromises the npm package publisher, package distribution process, or registry delivery path.
2. The attacker publishes or serves an altered release under @anthropic-ai/claude-code.
3. A user installs the dependency through this Skill's unpinned installation declaration.
4. The installer resolves the attacker-controlled release because no exact version or integrity value is required.
5. Malicious code executes during package installation or when scripts/invoke-claude.sh invokes the claude binary.
6. The payload operates with the privileges of the host user and may inherit the environment and Claude Code permissions available to that user.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the account installing or invoking Claude Code. ...[truncated 375 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @anthropic-ai/claude-code to a reviewed exact version rather than allowing mutable version resolution.
• Record and verify the package integrity hash through an npm lockfile or equivalent verified installation mechanism.
• Avoid version ranges and automatic installation of the latest release.
• Validate package provenance and signatures where supported.
• Review release artifacts and dependency changes before updating the pinned version.
• Perform installation with the minimum required operating-system privileges and isolate package lifecycle scripts where feasible.
• Document a controlled update process that includes vulnerability scanning and functional review before changing the pin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Referencing the host's ~/.claude/settings.json as the authorization mechanism means the skill depends on and potentially normalizes access to an agent configuration area containing trust and permission settings. Even though the document only mentions this path, the context is dangerous because delegated tooling with read capabilities may inspect sensitive configuration, and broad pre-authorizations in that file can silently expand what the subprocess may do.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

Prerequisites

Claude Code must be installed and authenticated on the host machine. The host's ~/.claude/settings.json must pre-authorize the tools this skill will use. Example minimal config:

json

{

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill delegates to a subprocess with filesystem editing and shell execution capabilities, but the skill manifest itself does not declare an explicit runtime tool scope or allowed-tools boundary for the host agent. That creates a governance gap: callers may invoke a highly capable workflow without a clear, machine-enforced restriction layer at the skill boundary, increasing the chance of over-broad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises file editing and shell execution but does not prominently warn users that it can modify repository contents or run impactful local commands. In practice, this can cause unsafe delegation of destructive actions such as changing files, running package scripts, or invoking git operations without the user appreciating the risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly notes that the subprocess inherits host environment variables, including API keys, but does not pair that with a strong warning or containment guidance. This is dangerous because any invoked shell command, dependency script, or delegated model action could access or expose sensitive credentials from the parent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends the full user-supplied prompt to the external claude CLI subprocess via stdin without any explicit warning, consent check, or data-sensitivity guardrail. In a skill specifically designed to dispatch coding tasks with file access and shell execution, prompts can easily contain secrets, proprietary code, or internal context, so silent transmission to an external model boundary creates a real data exposure risk.

Content

No source excerpt is available for this finding.