Claude Code Collaboration

• Outcome: Review
• Latest audit: May 28, 2026 · 10:49 AM UTC
• Version: 1.0.0

Overview

This skill connects OpenClaw to Claude Code as described, but it gives queued tasks broad automatic power and includes an embedded API token.

Review before installing. Do not run this as-is in a sensitive workspace or where untrusted users/processes can write queue files. Remove and rotate the embedded token, configure your own credentials securely, remove the permission-bypass flag unless you fully accept the risk, restrict the queue/work directories, and avoid submitting secrets or private code unless local logs and result files are protected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env["API_TIMEOUT_MS"] = "3000000"
        env["CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC"] = "1"

        result = subprocess.run(
            ["claude", "--print", "--no-session-persistence",
             "--dangerously-skip-permissions", prompt],
            cwd=WORK_DIR,

• Confidence: 92% confidence
• Finding: The code forwards untrusted queue-supplied prompts directly into an external agent process that is launched with elevated bypass flags. Even though shell injection is avoided by using an argument list, this is still dangerous because the downstream tool is explicitly allowed to act on attacker-controlled instructions without normal permission checks.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The agent contains a hardcoded API credential and endpoint configuration, then injects them into every spawned process. This creates a direct secret-exposure path and allows anyone who can read the file, logs, memory, or influence the child process to abuse the credential and external service.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The bridge launches Claude with --dangerously-skip-permissions even though its stated role is only to relay queue tasks. In this context, untrusted queue content can instruct the downstream agent to read, modify, or exfiltrate local data with reduced safeguards, substantially increasing the blast radius.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly documents that prompts and results are written to local files and that a conversation log is kept, but it does not warn users that potentially sensitive prompts, model outputs, and errors may persist on disk. This creates a real privacy and data-handling risk because users may unknowingly route secrets, proprietary code, or personal data into files such as `.oc-cc-chat.log` and `.oc-cc-out/*.json`.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: A live credential is embedded directly in code and then exported into the subprocess environment without disclosure or protection. Any compromise of the bridge, child process, repository, or host can expose the token and enable unauthorized API usage.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The subprocess is launched with an explicit safety-bypass option while consuming untrusted task input from a watched queue. The lack of any user confirmation, policy gate, or warning means queued prompts can trigger powerful actions automatically, turning the bridge into a privilege-escalation mechanism.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The logger persistently writes task content and later outputs to a plain-text log file. Because prompts may contain secrets, personal data, or operational instructions and model responses may echo sensitive material, this creates a durable local disclosure channel.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The output artifact intentionally stores the full original prompt, stdout, and stderr in JSON. In a queue-processing bridge, this bakes sensitive input and response data into files that may be accessible to other local users, backup systems, or downstream consumers.

Static analysis

No suspicious patterns detected.