Claude Code Collaboration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:11 AM UTC
• Version: 1.0.0

Overview

This skill is a real Claude Code bridge, but it runs queued prompts automatically with permission checks disabled and a hardcoded external API credential.

Review carefully before installing. This skill should only be run in a tightly controlled, low-privilege workspace after removing the hardcoded token, restoring normal Claude Code permission checks, protecting the queue directories, and deciding whether prompts and outputs may be sent to the configured external provider and stored locally.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/agent.py:56

Finding

Hardcoded API Authentication Token in Source Code

Content

View full analysis

Vulnerability Details

File Location: scripts/agent.py, line 56
Vulnerability Type: Hardcoded secret
Risk Level: High

Vulnerable Code

python

env["ANTHROPIC_AUTH_TOKEN"] = "sk-sp-5cec1d99ac9f4848b2dc625406bea113"

Technical Analysis

The source code contains a live-looking API bearer token. Because the token is distributed with the project, anyone who can read the source code can extract and attempt to use it.

The implementation also contradicts the environment-based configuration documented in SKILL.md. Instead of relying on an externally supplied secret, it unconditionally replaces ANTHROPIC_AUTH_TOKEN in the copied process environment. Secret rotation and deployment-specific configuration are therefore bypassed.

Attack Path

1. An attacker obtains a copy of the project source, package, repository history, artifact, or backup.
2. The attacker extracts the token from line 56.
3. The attacker submits requests to the configured Anthropic-compatible Alibaba Cloud API using the exposed token.
4. Requests are attributed to the account associated with the token until it is revoked, expires, or is otherwise restricted.

Impact Assessment

If the token remains valid, an attacker may consume the associated API quota, incur financial charges, exhaust rate limits, access resources available to the credential, or cause abuse-related account suspension. The exact scope depends on the server-side permissions assigned to the token.

The secret must be treated as compromised because it has already been embedded in distributable source code.

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed token immediately.
2. Remove the credential from the current source and repository history.
3. Obtain the token from a secret manager or deployment environment:

   python

   token = os.environ.get("ANTHROPIC_AUTH_TOKEN")
   if not token:
       raise RuntimeError("ANTHROPIC_AUTH_TOKEN is required")
   env["ANTHROPIC_AUTH_TOKEN"] = token
   

4. Use a dedicated, minimally privileged credential with spending limits, rate limits, and endpoint restrictions.
5. Add automated secret scanning to version-control and CI workflows.
6. Review provider logs for unauthorized use of the exposed credential.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/agent.py:69

Finding

Unauthenticated Queue Tasks Run Claude Code with Permission Checks Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/agent.py, lines 38–49 and 69–76
Vulnerability Type: Unsafe privileged execution of attacker-controlled tasks
Risk Level: Critical

Vulnerable Code

python

def process_task(task_file: Path):
    """处理单个任务"""
    task_id = task_file.stem
    
    try:
        with open(task_file, 'r', encoding='utf-8') as f:
            task = json.load(f)
        
        prompt = task.get("prompt", "")
        if not prompt:
            raise ValueError("任务中没有 prompt 字段")

python

        result = subprocess.run(
            ["claude", "--print", "--no-session-persistence",
             "--dangerously-skip-permissions", prompt],
            cwd=WORK_DIR,
            capture_output=True,
            text=True,
            timeout=120,
            env=env
        )

The queue-processing loop that exposes this path is:

python

    while True:
        # 检查输入队列
        for task_file in Path(IN_DIR).glob("*.json"):
            process_task(task_file)
        
        time.sleep(2)  # 每 2 秒检查一次

Technical Analysis

Every JSON file found in the input directory is accepted as a task. The code performs no authentication of the producer, authorization check, signature verification, ownership validation, restrictive schema validation, or task allowlisting.

The attacker-controlled prompt is passed as a direct argument rather than through a shell, so this is not conventional shell metacharacter injection. The vulnerability instead arises from deliberately invoking an autonomous coding agent with --dangerously-skip-permissions. That option removes the normal approval boundary for tools and operations available to Claude Code.

Claude Code runs with:

• The permissions of the interface-agent operating-system account.
• /Volumes/256G/mywork as its working directory.
• The inherited process environment, supplemente ...[truncated 2170 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --dangerously-skip-permissions and retain interactive or policy-based approval for sensitive operations.
2. Authenticate task producers using signed task documents, a protected IPC mechanism, or another cryptographically authenticated channel.
3. Apply strict filesystem permissions to input and output directories so only the intended producer and consumer can access them.
4. Validate tasks against a restrictive schema, including length limits and explicitly supported operation types.
5. Replace unrestricted natural-language execution with a narrow allowlist of deterministic operations wherever possible.
6. Run the agent under a dedicated low-privilege operating-system account.
7. Execute Claude Code in an isolated container or sandbox with:
   • A minimal read-only filesystem.
   • A task-specific writable directory.
   • No access to host secrets.
   • Restricted process capabilities.
   • Disabled or allowlisted outbound networking.
   • CPU, memory, file-size, and execution-time limits.
8. Use a task-specific workspace instead of the broad hardcoded /Volumes/256G/mywork directory.
9. Reject symlinks, unexpected file ownership, insecure file modes, oversized files, and malformed queue entries.
10. Add security auditing for task identity and requested operation type without recording sensitive prompt content.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agent.py:21

Finding

Sensitive Prompts and Model Responses Are Persistently Logged in Plaintext

Content

View full analysis

Vulnerability Details

File Location: scripts/agent.py, lines 17, 21–26, 50–51, and 99–103
Vulnerability Type: Plaintext sensitive-data logging
Risk Level: Medium

Vulnerable Code

python

LOG_FILE = f"{WORK_DIR}/.oc-cc-chat.log"

python

def log(message: str):
    """写入对话日志"""
    timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
    line = f"[{timestamp}] {message}\n"
    with open(LOG_FILE, 'a', encoding='utf-8') as f:
        f.write(line)
    print(line.strip())

Prompt content is sent to the logger:

python

        log(f"📤 OPENCLAW → CLAUDE CODE [任务: {task_id}]")
        log(f"    提示词: {prompt[:100]}{'...' if len(prompt) > 100 else ''}")

Model output and errors are also logged:

python

        log(f"📥 CLAUDE CODE → OPENCLAW [任务: {task_id}]")
        if stdout:
            log(f"    输出: {stdout[:200]}{'...' if len(stdout) > 200 else ''}")
        if stderr:
            log(f"    错误: {stderr[:200]}{'...' if len(stderr) > 200 else ''}")

Technical Analysis

The application persistently records the first 100 characters of each prompt and the first 200 characters of model output and error text. Truncation is not sanitization: credentials, personal data, source fragments, internal hostnames, and other sensitive values frequently occur near the beginning of a message.

The same content is also printed to standard output. It may therefore be copied into terminal history, service-manager logs, container logs, or centralized observability systems.

The log file is opened with the process's default permission behavior. The code does not explicitly enforce restrictive file permissions, redact secrets, rotate logs, limit retention, obtain user consent, or prevent symlink-based redirection of the log path.

Attack Path

1. A legitimate user submits a prompt containing sensitive source code, credentials, personal information, or internal o ...[truncated 1132 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable prompt, response, and error-content logging by default.
2. Record only non-sensitive metadata such as task ID, state, duration, and return code.
3. If content logging is operationally required, make it explicit opt-in and apply structured redaction for credentials, tokens, personal data, and other secrets.
4. Create logs with restrictive permissions such as 0600, and ensure the containing directory is accessible only to the dedicated service account.
5. Prevent symlink and special-file attacks when opening the log, or use a security-reviewed logging framework and protected directory.
6. Configure log rotation, maximum size, short retention, and secure deletion.
7. Protect standard output because it may be captured by service managers or centralized logging platforms.
8. Document what data is collected, where it is stored, who can access it, and how long it is retained.
9. Avoid including raw provider errors when those errors may reproduce request data or credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Copying the full parent environment into a subprocess can unintentionally pass through unrelated credentials, API keys, proxy settings, and other sensitive variables to a tool that is processing untrusted prompts. Given this agent also grants broad execution latitude to the invoked CLI, inherited secrets may be exposed to downstream actions or remote services.

Content

Scanner excerpt · scripts/agent.py (reported line 58)May include surrounding context.

python

# 调用 Claude Code 执行任务
        # 复制当前环境并添加 Claude Code 所需的环境变量
        env = os.environ.copy()
        env["ANTHROPIC_AUTH_TOKEN"] = "sk-sp-5cec1d99ac9f4848b2dc625406bea113"
        env["ANTHROPIC_BASE_URL"] = "https://coding.dashscope.aliyuncs.com/apps/anthropic"
        env["ANTHROPIC_MODEL"] = "qwen3.5-plus"

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The agent hardcodes an external service credential and endpoint into the source code, which exposes a reusable secret to anyone with code or log access and enables unauthorized use of the upstream service. In a queue-processing bridge, this also silently routes user tasks and potentially sensitive content to a third-party endpoint without strong separation or secret management.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The agent invokes Claude with '--dangerously-skip-permissions', disabling normal safety checks while processing untrusted queued tasks. Because the documented purpose is only task bridging, this unrestricted permission bypass creates a large gap between intended functionality and actual authority, enabling high-risk actions without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The subprocess is launched with a dangerous permission bypass and no user warning, confirmation, or interactive approval, so queued input can trigger powerful actions automatically. This creates an unsafe non-interactive execution path where malicious or malformed tasks may be processed without any human checkpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly routes user prompts and model outputs through an external API and also documents local logging/output files, but it does not warn users that potentially sensitive prompts, results, and metadata will leave the local environment and be persisted on disk. This creates a real privacy and data-handling risk, especially if the main agent processes secrets, proprietary code, or regulated data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill sets up persistent workspace directories and describes logs, status files, and result queues that retain prompts and outputs across sessions. This persistence can expose sensitive conversations or task data to other local users, later processes, or accidental reuse if file permissions, retention, and cleanup are not explicitly controlled.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

3. Start the Interface Agent

bash

mkdir -p ~/.openclaw/agents/main/workspace/.oc-cc-in
mkdir -p ~/.openclaw/agents/main/workspace/.oc-cc-out

python3 agent.py &

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The agent persistently logs prompts and stores model outputs/results on disk, which can capture sensitive user data, internal instructions, file contents, or secrets returned by the model. In a queue bridge that processes arbitrary tasks, these artifacts become a durable local leakage channel and may be readable by other users or backup systems.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 93% confidence

Finding

The code executes the Claude CLI on untrusted queue-supplied prompts, which gives external input direct influence over an agent capable of taking actions in the working directory. This is especially dangerous because the invocation also includes a permission-bypass flag, turning a generic subprocess call into an automated execution bridge with little safety control.

Content

Scanner excerpt · scripts/agent.py (reported line 69)May include surrounding context.

python

env["API_TIMEOUT_MS"] = "3000000"
        env["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"] = "1"

        result = subprocess.run(
            ["claude", "--print", "--no-session-persistence",
             "--dangerously-skip-permissions", prompt],
            cwd=WORK_DIR,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The documentation hard-codes a specific external provider endpoint and model path without explaining alternatives, user choice, or trust implications. While not inherently exploitable on its own, this can steer users into sending data to a particular external service without adequate disclosure or justification, increasing supply-chain and privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The module docstring and all user-facing status/log messages are written in Chinese, indicating the skill is designed around a single language presentation. There is no indication that users can choose another language or that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.