Claude Code Dispatch

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:57 AM UTC
• Version: 1.0.0

Overview

This skill is a clearly disclosed bridge to run Claude Code on local coding tasks, but users should treat it as a powerful delegation tool that can expose project data and local environment secrets to Claude Code.

Install this only if you intentionally want an OpenClaw agent to hand coding tasks to your authenticated Claude Code CLI. Use the narrowest --tools preset that works, prefer read-only mode for review, avoid passing secrets in prompts, and run from an environment with only the credentials needed for the task. Pin or separately manage the Claude Code dependency if reproducible installs matter to you.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned Claude Code npm Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 12 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Complete Code Snippet**: ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["claude","jq"]},"install":[{"id":"claude","kind":"npm","package":"@anthropic-ai/claude-code","bins":["claude"],"label":"Install Claude Code (npm)"},{"id":"jq","kind":"brew","formula":"jq","bins":["jq"],"label":"Install jq (brew)"}]}} ``` ### Technical Analysis The installation metadata references `@anthropic-ai/claude-code` without an exact version or integrity hash. Consequently, installation may resolve whichever package release the registry serves at that time rather than the release reviewed with this Skill. Although the package name uses Anthropic's expected npm scope and no malicious package behavior is demonstrated in the audited files, the absence of version and integrity pinning creates supply-chain exposure. A compromised publisher account, registry response, or future malicious release could cause unreviewed executable code to be installed. ### Attack Path 1. An attacker compromises the npm package publisher, package distribution process, or registry delivery path. 2. The attacker publishes or serves an altered release under `@anthropic-ai/claude-code`. 3. A user installs the dependency through this Skill's unpinned installation declaration. 4. The installer resolves the attacker-controlled release because no exact version or integrity value is required. 5. Malicious code executes during package installation or when `scripts/invoke-claude.sh` invokes the `claude` binary. 6. The payload operates with the privileges of the host user and may inherit the environment and Claude Code permissions available to that user. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the account installing or invoking Claude Code. ...[truncated 375 chars]
• Remediation: ## Remediation Suggestions - Pin `@anthropic-ai/claude-code` to a reviewed exact version rather than allowing mutable version resolution. - Record and verify the package integrity hash through an npm lockfile or equivalent verified installation mechanism. - Avoid version ranges and automatic installation of the latest release. - Validate package provenance and signatures where supported. - Review release artifacts and dependency changes before updating the pinned version. - Perform installation with the minimum required operating-system privileges and isolate package lifecycle scripts where feasible. - Document a controlled update process that includes vulnerability scanning and functional review before changing the pin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Agent Config Directory Access

High

• Category: Agent Snooping

Content

## Prerequisites

Claude Code must be installed and authenticated on the host machine. The host's `~/.claude/settings.json` must pre-authorize the tools this skill will use. Example minimal config:

```json
{

• Confidence: 90% confidence
• Finding: Referencing the host's ~/.claude/settings.json as the authorization mechanism means the skill depends on and potentially normalizes access to an agent configuration area containing trust and permission settings. Even though the document only mentions this path, the context is dangerous because delegated tooling with read capabilities may inspect sensitive configuration, and broad pre-authorizations in that file can silently expand what the subprocess may do.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill delegates to a subprocess with filesystem editing and shell execution capabilities, but the skill manifest itself does not declare an explicit runtime tool scope or allowed-tools boundary for the host agent. That creates a governance gap: callers may invoke a highly capable workflow without a clear, machine-enforced restriction layer at the skill boundary, increasing the chance of over-broad execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises file editing and shell execution but does not prominently warn users that it can modify repository contents or run impactful local commands. In practice, this can cause unsafe delegation of destructive actions such as changing files, running package scripts, or invoking git operations without the user appreciating the risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly notes that the subprocess inherits host environment variables, including API keys, but does not pair that with a strong warning or containment guidance. This is dangerous because any invoked shell command, dependency script, or delegated model action could access or expose sensitive credentials from the parent environment.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script sends the full user-supplied prompt to the external `claude` CLI subprocess via stdin without any explicit warning, consent check, or data-sensitivity guardrail. In a skill specifically designed to dispatch coding tasks with file access and shell execution, prompts can easily contain secrets, proprietary code, or internal context, so silent transmission to an external model boundary creates a real data exposure risk.

Static analysis

No suspicious patterns detected.