Security audit

Claude Code Invoke

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small, disclosed helper for invoking Claude Code, but it makes permission-skipping and unsafe shell invocation the default for user-supplied tasks.

Review before installing. Only use this skill in a trusted, disposable or well-scoped repository, avoid passing untrusted prompt text or paths, and remove `--dangerously-skip-permissions` unless you have explicitly accepted unattended file, command, credential, and network access by Claude Code.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:25
Finding: Claude Code Permission Safeguards Are Unconditionally Disabled
Content: View full analysis
&& claude -p "" --dangerously-skip-permissions ``` ### Technical Analysis The documented core command unconditionally passes `--dangerously-skip-permissions` to Claude Code. This option suppresses the normal authorization prompts that would otherwise require operator approval before sensitive tools or actions are used. Routine tasks such as code analysis, data retrieval, and code review do not inherently require all permission checks to be disabled. Making this option the default violates least privilege and removes an important control between user-controlled prompts and consequential operations. The flag does not grant operating-system administrator privileges by itself. However, it allows Claude Code to use its available tools without interactive approval, subject to the permissions of the account running the command. Depending on the local Claude Code configuration, this could permit reading or modifying files, executing commands, accessing repository credentials, or communicating with external services. ### Attack Path 1. An attacker or untrusted user submits a task that appears to be a legitimate analysis request. 2. The skill embeds that task in a `claude -p` invocation. 3. The invocation includes `--dangerously-skip-permissions`. 4. The submitted prompt directs Claude Code to perform an additional sensitive action, such as reading repository secrets, modifying source files, or executing a local program. 5. Claude Code performs the action without presenting the normal permission confirmation. 6. The action executes with the filesystem, process, credential, and network access available to the account running Claude Code. ### Impact Assessment Successful exploitation can bypass Claude Code's interactive authorization boundary. ...[truncated 632 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:41
Finding: PowerShell Command Injection Through Unescaped Prompt and Repository Path
Content: View full analysis
'; claude -p '' --dangerously-skip-permissions" ``` ### Technical Analysis The documented command constructs a PowerShell program by directly interpolating the target directory and prompt into a `-Command` string. Both values are enclosed with literal single quotes, but the instructions do not require validation or PowerShell-safe escaping. In PowerShell, an attacker-controlled single quote can terminate a single-quoted string. The attacker can then add a statement separator and an additional command. Comment syntax can be used to suppress the remainder of the intended command. Other shell-significant characters may also affect parsing because the complete expression is passed through a command interpreter. For example, a malicious prompt value conceptually shaped as the following can escape the intended argument: ```text '; ; # ``` The same weakness applies to an attacker-influenced repository path. Exploitation occurs in PowerShell before `claude` safely receives the intended prompt, so Claude Code's own prompt handling does not prevent the injected shell command. The simultaneous use of `--dangerously-skip-permissions` compounds the risk but is not required for PowerShell injection: an injected command is interpreted directly by PowerShell with the privileges of the invoking account. ### Attack Path 1. An attacker supplies or influences the prompt or target repository path. 2. The supplied value contains a closing single quote followed by PowerShell syntax that introduces another command. 3. The skill inserts the value into the `powershell -Command` string without validation or escaping. 4. PowerShell parses the attacker's syntax as executable statements rather than as data belonging to the path or prompt. 5. ...[truncated 1054 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill repeatedly instructs use of claude -p ... --dangerously-skip-permissions, which disables an important safety control and normalizes unattended execution of a powerful external agent. Because the prompt content may originate from user requests and the target repository may contain sensitive code or data, this can lead to unauthorized file access, code changes, command execution, or data exfiltration without an approval checkpoint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill's natural-language description and usage guidance are entirely in Chinese and all invocation examples assume Chinese phrasing, with no indication that other languages are supported or that Chinese is a justified requirement. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.