Security audit

Kindle Claude Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local Claude Code monitor, but it exposes Claude workflow data on the local network and installs persistent hooks without strong user controls.

Install only on a trusted private network. Expect Claude Code hook activity, including commands, paths, prompts or notifications depending on payloads, to be logged locally and potentially visible to devices that can reach port 8787. Review the hook changes and launchd service first, avoid disabling firewall protections unless necessary, and remove the service with uninstall.sh when no longer needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The installer directly modifies ~/.claude/settings.json to register seven event hooks, creating new execution paths inside Claude Code beyond merely copying files for a monitor. In context this behavior is functionally related to the monitor, but it is still a security-relevant configuration change because it causes future Claude sessions to invoke local commands automatically without an explicit approval step at install time.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script installs a launchd plist into ~/Library/LaunchAgents and immediately loads it, establishing a persistent background service. Although this appears intended to support the monitor server, persistence materially changes the user's environment and expands attack surface because the service will continue running across sessions and may expose a local network endpoint.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The server exposes /raw.json, which returns full in-memory state and recent event data in machine-readable form, and the application also persists incoming event payloads to a JSONL log file. In the context of a local network dashboard, this expands the data exposure surface beyond passive visual monitoring and can leak sensitive prompts, tool inputs, file paths, commands, session identifiers, and notifications to any party that can reach the service or read the log file.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The /reset endpoint is reachable via unauthenticated GET and mutates shared server state, clearing alerts and recent events. Because the server listens on 0.0.0.0 for use from other devices, any host on the reachable network can tamper with the monitor's display, suppress waiting-for-confirmation indications, or hide operational context, undermining the monitor's integrity.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README explicitly states that the service binds to 0.0.0.0:8787 and that Claude Code hook events are forwarded to it, but it does not warn that this exposes workflow metadata and potentially sensitive prompts/tool activity to any device on the local network. In this skill context, the risk is heightened because the feature is specifically designed for remote viewing from a Kindle or phone over LAN, so users may not realize they are broadcasting session state beyond localhost.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README instructs users to disable macOS firewall stealth mode to make the service reachable, but does not explain the security tradeoff of reducing host stealth on the network. This can make the machine more discoverable to other systems on the LAN and encourages users to weaken host protections without understanding the implications.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installer edits the user's Claude configuration and adds hooks automatically, with no interactive confirmation or opt-in. This is dangerous because hooks execute commands on future Claude events, so silent installation can surprise users and normalize unauthorized automation in a trusted config file.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script installs and starts a launchd agent immediately after rendering the plist, without asking the user for permission. Launching a persistent background process without confirmation reduces user control and can leave an unexpected network-accessible service running on the machine.

Static analysis

No suspicious patterns detected.