Security audit

Claude Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a legitimate Claude Code automation guide, but it promotes unattended high-impact repository actions with weak scoping and unsafe command patterns.

Review carefully before installing. Use only in an isolated, disposable workspace with least-privilege credentials, avoid --dangerously-skip-permissions unless containment is verified, do not feed sensitive diffs or logs to unapproved providers, and require human review before pushes, PRs, production access, or broad Bash commands.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:434
Finding: Shell Command Injection Through Unescaped Prompt and Failure-Log Interpolation
Content: View full analysis
> $LOG_FILE" tmux send-keys -t "$TASK_ID" "$PROMPT" Enter } ``` ### Technical Analysis `tmux send-keys` does not pass an argument array directly to a process. It types the supplied text into the shell running in the target pane. Consequently, the shell parses all quotes, newlines, substitutions, redirections, separators, and other metacharacters contained in that text. The retry workflow places `FAILURE_LOG` and `CI_LOG` inside a single-quoted Claude prompt embedded in a larger shell command. These values can contain repository-controlled build output, test failures, filenames, exception messages, or other attacker- ...[truncated 2382 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:193
Finding: Systematic Permission Bypass Without Enforced Sandbox Verification
Content: View full analysis
&1 | tee -a $LOG_FILE", workdir="/path/to/project", background=true, pty=true) ``` ### Technical Analysis The primary workflows routinely invoke Claude Code with `--dangerously-skip-permissions`. This disables approval prompts for agent-initiated actions while the surrounding workflow expects the agent to edit files, execute shell commands, install dependencies, run tests, push branches, create pull requests, and send system notifications. The documentation states that this is safe in containers or virtual machines, but it does not enforce or verify any of the security properties required for that assumption. It does not confirm that: - The process is actually inside an ephemeral sandbox. - The container is unprivileged. - Sensitive host paths are not mounted. - Git, cloud, package-registry, or SSH credentials are absent. - Network access is appropriately restricted. - The agent cannot access host contro ...[truncated 2139 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger text is extremely broad: 'use when user asks to leverage claude or claude code to do something,' which can match ordinary coding conversations. Because this skill enables powerful autonomous execution, overbroad invocation materially raises the risk of accidental activation and unintended file, shell, git, and network actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description explicitly advertises 'hands-off task execution without approval prompts,' while the skill later recommends permission skipping and autonomous code changes. This combination is dangerous because it normalizes bypassing checkpoints for write, shell, and remote actions without a front-loaded warning to the user about the breadth of side effects.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · SKILL.md (reported line 538)May include surrounding context.
md
--output-format json | jq -r '.session_id') # Continue with context from previous turn claude -r "$session_id" -p "now implement the changes we discussed" \ --dangerously-skip-permissions # Resume in non-interactive mode

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · SKILL.md (reported line 542)May include surrounding context.
--dangerously-skip-permissions

Resume in non-interactive mode

claude -r "$session_id" -p "fix the remaining test failures"
--dangerously-skip-permissions

text

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 9)May include surrounding context.
Command:

bash
claude -p "count the total number of lines of code in this project, broken down by language" \ --allowedTools "Read,Bash(find),Bash(wc)"

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 21)May include surrounding context.
Command:

bash
claude -p "fix the authentication bug in the login flow" \ --permission-mode acceptEdits \ --allowedTools "Bash,Read,Write,Edit"

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 34)May include surrounding context.
Command:

bash
claude -p "add dark mode support to the UI with theme context and style updates" \ --permission-mode acceptEdits \ --allowedTools "Bash,Read,Write,Edit"

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 47)May include surrounding context.
Command:

bash
claude -p "update all imports from old-lib to new-lib across the entire codebase" \ --permission-mode acceptEdits \ --allowedTools "Read,Write,Edit,Bash(npm test)"

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 60)May include surrounding context.
Command:

bash
claude -p "analyze the codebase for security vulnerabilities and provide a detailed report" \ --allowedTools "Read,Grep" \ --output-format json

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 73)May include surrounding context.
Command:

bash
claude -p "Incident: Payment API returning 500 errors (Severity: high)" \ --append-system-prompt "You are an SRE expert. Diagnose the issue, assess impact, and provide immediate action items." \ --output-format json \ --allowedTools "Bash,Read,mcp__datadog" \

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 106)May include surrounding context.
md
session_id=$(claude -p "start legal review session" --output-format json | jq -r '.session_id') # Review in multiple steps claude -r "$session_id" -p "review contract.pdf for liability clauses" \ --permission-mode acceptEdits claude -r "$session_id" -p "check compliance with GDPR requirements" \ --permission-mode acceptEdits

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 108)May include surrounding context.
md
# Review in multiple steps claude -r "$session_id" -p "review contract.pdf for liability clauses" \ --permission-mode acceptEdits claude -r "$session_id" -p "check compliance with GDPR requirements" \ --permission-mode acceptEdits claude -r "$session_id" -p "generate executive summary of risks" \ --permission-mode acceptEdits

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · references/examples.md (reported line 110)May include surrounding context.
--permission-mode acceptEdits claude -r "$session_id" -p "check compliance with GDPR requirements"
--permission-mode acceptEdits claude -r "$session_id" -p "generate executive summary of risks"
--permission-mode acceptEdits

text

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: The skill is expressly designed for autonomous operation 'without approval prompts,' which delegates consequential decisions to the agent. In context, that autonomy is paired with code changes, shell execution, and repository operations, making mistakes or prompt-induced misuse more impactful than a read-only or advisory skill.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: claude-skill description: 'Use when user asks to leverage claude or claude code to do something (e.g. implement a feature design or review codes, etc). Provides non-interactive automation mode for hands-off task execution without approval prompts.' --- # Claude Code Agent Skill

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill’s stated purpose is to use Claude/Claude Code for coding help, but the body expands into end-to-end repository operations including branch creation, commits, pushes, PR creation, and merge-adjacent workflow. This scope expansion increases the chance a user invokes the skill expecting analysis or implementation assistance but instead authorizes autonomous remote side effects on source control infrastructure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: These instructions direct the agent to autonomously commit, push a branch, create a PR, and emit a completion event, which are external side effects beyond simple code generation. If triggered unexpectedly or with an unsafe prompt, this can publish unreviewed code, leak sensitive diffs to remote services, and create workflow noise or policy violations without human approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: These examples encourage edit-capable, repository-wide modification workflows using Write/Edit and broad Bash access, but they do not warn that the model may change many files at once or that outputs should be reviewed before applying. In a hands-off automation skill, that omission increases the chance of unintended bulk changes, destructive edits, or unsafe automated refactors being run by users without adequate caution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The incident-response example grants broad Bash access plus external monitoring access to Datadog without warning about exposure of logs, credentials, customer data, or the possibility of making impactful production-facing commands. In the context of a non-interactive automation skill, users may over-trust the example and provide broad operational access without considering privacy and system safety constraints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Piping a PR diff directly into the external model can transmit proprietary code, secrets, or sensitive security fixes, yet the example gives no warning about data disclosure. Because this skill is specifically for using an external provider in automation mode, the lack of disclosure guidance materially increases the risk of unintended code exfiltration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill introduces a second external model/tool, codex, for code review even though the manifest frames the skill as Claude-focused. This broadens data exposure by sending PR diffs to another provider and may violate user expectations, data handling policies, or confidentiality requirements.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Vague Triggers

Missing User Warnings

External Model or Provider Selection

External Model or Provider Selection

Resume in non-interactive mode

External Model or Provider Selection

External Model or Provider Selection

External Model or Provider Selection

External Model or Provider Selection

External Model or Provider Selection

External Model or Provider Selection

External Model or Provider Selection

External Model or Provider Selection

External Model or Provider Selection

Autonomous Decision Making

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Static analysis