T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:45- Finding
Unverified Remote Script Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw ClaudeCode Controller
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent with controlling Claude Code through tmux, but it defaults to high-impact automation that bypasses permission checks and auto-approves prompts.
Install only if you intentionally want an agent to run Claude Code unattended in tmux. Avoid the curl-to-shell installer, do not use --dangerously-skip-permissions by default, do not auto-send confirmations, provision any non-root account through normal admin processes, and run it only in a tightly scoped project sandbox with disposable credentials.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:131- Finding
Claude Code Permission Controls Disabled by Default
- Content
View full analysis
"su - -c 'cd && claude --dangerously-skip-permissions'" Enter ``` ```markdown **Key Parameters**: - `--dangerously-skip-permissions`: Skip all confirmation prompts, fully automatic - `--print`: Silent mode, buffer output until complete (for background tasks) ``` The same unsafe flag is repeated in the complete example and troubleshooting instructions: ```bash tmux send-keys -t cc- "su - claudecode -c 'cd && claude --dangerously-skip-permissions'" Enter ``` ```bash tmux send-keys -t "claude --dangerously-skip-permissions" Enter ``` ### Technical Analysis The workflow deliberately invokes Claude Code with `--dangerously-skip-permissions`, disabling its normal confirmation and permission controls. These controls are intended to constrain sensitive operations such as shell execution and file modification. Running the agent as a non-root user limits the maximum operating-system privilege but does not establish least privilege within that user's environment. The agent may still access or modify the selected user's source code, configuration, credentials, SSH material, API tokens, and other files allowed by operating-system permissions. This bypass exceeds the minimum privileges required to create and monitor a `tmux` session. Long-running automation does not inherently require removing all operation-level authorization. ### Attack Path 1. The Skill launches Claude Code inside a project with `--dangerously-skip-permissions`. 2. Claude Code processes the user's prompt and project-controlled content. 3. A malicious instruction in a prompt or repository, or an erro ...[truncated 806 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:165- Finding
Generic Terminal Prompts Are Automatically Confirmed Without Operation Validation
- Content
View full analysis
-p | tail -10 | grep -E "❯|Yes.*No|proceed|permission|y/n" ``` ```bash # Send confirmation tmux send-keys -t y Enter # Send cancel tmux send-keys -t n Enter ``` The troubleshooting section repeats the behavior: ```bash tmux capture-pane -t -p | tail -5 | grep -E "y/n|Yes|No|proceed" ``` ```bash tmux send-keys -t y Enter ``` ### Technical Analysis The detection expression only looks for generic textual patterns such as `proceed`, `permission`, and `y/n`. It does not identify the process that generated the prompt, the exact requested operation, or the consequences of approving it. Sending `y` through `tmux` authorizes whichever interactive process currently owns the terminal. A development tool, package manager, shell script, or attacker-controlled program can display matching text and receive the confirmation. The workflow therefore substitutes broad string matching for informed authorization. This behavior is especially dangerous in combination with autonomous command execution, but it is independently unsafe even if normal permission controls are restored. ### Attack Path 1. A process in the managed `tmux` pane displays a prompt containing a matching phrase such as `proceed` or `y/n`. 2. The monitoring command classifies the pane as waiting for confirmation. 3. The documented auto-confirm procedure sends `y` followed by Enter. 4. The active process interprets the input as authorization. 5. A destructive, security-sensitive, or unrelated operation proceeds without the user reviewing its exact details. An attacker-controlled script can intentionally print a matching prompt immediately before requesting aut ...[truncated 508 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:131- Finding
Untrusted Placeholders Are Interpolated into Nested Shell Commands
- Content
View full analysis
"su - -c 'cd && claude --dangerously-skip-permissions'" Enter ``` ```bash # Single line command tmux send-keys -t "" Enter ``` The complete example uses the same construction: ```bash tmux send-keys -t cc- "su - claudecode -c 'cd && claude --dangerously-skip-permissions'" Enter ``` ```bash tmux send-keys -t cc- "" Enter ``` ### Technical Analysis Session names, usernames, project paths, and prompts are represented as placeholders inserted directly into shell command text. The most sensitive construction contains multiple nested parsing contexts: 1. The local shell parses the `tmux send-keys` command. 2. `tmux` sends a generated string to the pane. 3. The pane's shell parses `su`. 4. `su -c` invokes another shell that parses `cd && claude ...`. No validation or escaping rules are provided for any placeholder. Quote characters, semicolons, command substitutions, redirections, or other shell metacharacters can therefore alter the intended command structure. The prompt submission is also unsafe. A quote can terminate the local `tmux send-keys` argument when an operator substitutes it directly into the example. Moreover, if Claude Code has exited and the pane is at a shell prompt, text intended as an AI prompt can instead be interpreted as a shell command. ### Attack Path 1. An attacker influences a project path, session name, username, or development prompt used with the documented command. 2. The value contains shell syntax that escapes or changes the surrounding quoting context. 3. The operator or agent substitutes the value in ...[truncated 983 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:68- Finding
Plaintext Password Is Embedded in a Shell Command
- Content
View full analysis
# Set password (optional) echo ":" | chpasswd ``` ### Technical Analysis The instruction requires the user to substitute a plaintext password directly into a shell command. Depending on how it is executed, the resulting command can be retained in shell history, terminal transcripts, automation logs, audit records, or captured `tmux` output. The password may also be disclosed to processes or users capable of observing command execution. Although `chpasswd` accepts credentials through standard input, placing the secret literally in the preceding `echo` command defeats the protection that would otherwise be gained by avoiding command-line secrets. Creating a password is marked optional and is not necessary for the Skill's declared purpose of running Claude Code as a non-root account. ### Attack Path 1. An administrator replaces `` with a real credential. 2. The completed command is run in a shell or submitted through automation. 3. The command text is stored in history, logs, or terminal capture, or is observed during execution. 4. Another local user, administrator, logging service, or party with access to those records retrieves the plaintext password. 5. The exposed credential is used to authenticate as the created account or against another service if the password was reused. ### Impact Assessment Disclosure compromises the newly created local account and all files, processes, and credentials accessible to it. If the password is reused elsewhere, the impact can extend beyond the audited host. The instruction does not itself grant root access to the created account, and no sudo configuration is shown. The confirmed scope is therefore the account protected by the exposed password ...[truncated 54 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Fetching a remote script with curl and piping it directly to sh is a classic unsafe pattern that executes unreviewed code from the network immediately. In a skill file, this is especially dangerous because it turns mere activation of the skill into arbitrary code execution and inherits any compromise of the remote host, DNS, TLS trust chain, or transient content changes.
- Content
npm install -g @anthropic-ai/claude-code
Or use official install script
curl -fsSL https://claude.ai/install.sh | sh
text ### 0.3 Verify Claude Code Works
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The pipe into sh creates an execution chain where network-fetched content is immediately interpreted by the shell, eliminating meaningful inspection points. This pattern materially increases exploitability because any upstream compromise or content substitution becomes direct command execution on the host.
- Content
npm install -g @anthropic-ai/claude-code
Or use official install script
curl -fsSL https://claude.ai/install.sh | sh
text ### 0.3 Verify Claude Code Works
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
claude --version
Test simple call (requires valid authentication)
claude --print "hello" 2>&1 | head -5
text **Common Issues**:
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs creating local user accounts and optionally setting passwords, which is a privileged system administration action unrelated to merely sending commands to an existing tmux/Claude Code setup. In a hostile or mistaken context, this could create persistence, expand access paths, or alter local authentication state without sufficient justification.
- Content
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
id || echo "❌ user missing"
echo "=== auth ===" claude --print "test" 2>&1 | grep -E "error|Error" && echo "❌ auth failed" || echo "✅ auth ok" } check_env
text
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill launches Claude Code with --dangerously-skip-permissions and presents it as a required parameter without a prominent warning. This disables confirmation gates that are meant to prevent unintended file changes, command execution, or other sensitive actions, making downstream prompts far more dangerous.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill describes detecting prompts and automatically answering them, including sending 'y', without warning that this can approve unintended or unsafe actions. In combination with a coding agent, auto-confirmation can authorize destructive operations, secrets exposure, or system changes that would otherwise have been reviewed.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
Storing session identifiers and timing in a memory file can leak contextual information across tasks, users, or future runs. Even if the content seems low sensitivity, it can expose project names, cadence, and links between activities that help an attacker infer or target ongoing work.
- Content
md 1. **Must check environment on first use**: tmux, claude, regular user, authentication 2. **Clear session naming**: `cc-<project>-<task>` for managing multiple tasks 3. **Regular progress check**: Use `capture-pane` every 30 minutes 4. **Record session ID**: Note session name and start time in memory file 5. **Clean residual attach**: Regularly check `tmux list-clients` and cleanup ---
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The skill's declared purpose includes auto-confirming prompts, which signals a design for autonomous approval rather than human-reviewed operation. In context, that increases risk because the skill is meant to drive a powerful coding tool that may request confirmation before impactful actions.
- Content
md --- name: openclaw-claudecode description: | Control Claude Code (cc) via tmux to execute development tasks. Use for: starting CC development sessions, sending development commands, monitoring progress, auto-confirming prompts. Trigger: user requests "start CC development", "use Claude Code to develop", "tmux + cc to execute task", "monitor CC progress", "check CC output". Not for: simple code edits (use edit tool directly), non-development Claude conversations. metadata:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill provides package installation commands as routine setup steps without clearly warning that they modify the system and may require elevated privileges. In security-sensitive environments, normalizing these commands increases the chance of unintended host changes and broadens the blast radius of using the skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill goes beyond tmux-based control of Claude Code and instructs installation of software, including piping a remote script directly to the shell. That expands its authority from session management into host modification and arbitrary code execution, which is dangerous in an adversarial skill because the fetched script can change over time and execute with the caller's privileges.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The explicit auto-confirm/interact section operationalizes autonomous decision-making by programmatically answering prompts. In this context, the danger is elevated because prompt requests are often the safety boundary for tools that modify code, run commands, or access resources.
- Content
tmux capture-pane -t <session_name> -p | tail -10 | grep -E "❯|Yes.*No|proceed|permission|y/n"
text ### 6. Auto-confirm/Interact ```bash # Send confirmation
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Session attachment management and force-detaching other tmux clients exceeds the stated purpose of monitoring Claude Code progress and can disrupt other operators or conceal concurrent oversight. In a shared environment this can be abused to interfere with legitimate monitoring or take exclusive control of an active session.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The instruction to record session name and start time in a memory file creates unnecessary retention of operational metadata. In aggregate, such notes can leak project identities, activity timing, and workflow context to later tasks or unauthorized viewers, especially if the memory store is broadly accessible.
- Content