OpenClaw Claude Delegate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 0.2.6

Overview

This is a real Claude delegation skill, but it needs review because it grants broad local execution authority and can copy privileged Claude credentials into a runner account.

Install only if you intentionally want a local Claude worker with broad file and command authority. Use a narrow project profile instead of the packaged HOME workspace, avoid running setup as root, do not copy root Claude credentials into a runner unless you accept that boundary change, prefer a reviewed local install over curl | bash or unpinned npx, and treat --notify-cmd as arbitrary local command execution.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:84

Finding

Remote Installer Is Executed Without Integrity Verification

Content

View full analysis

&2 if curl --retry 3 --retry-all-errors --retry-delay 2 -fsSL "$url" -o "$archive"; then tar -xzf "$archive" -C "$TMP_DIR" find "$TMP_DIR" -mindepth 1 -maxdepth 1 -type d | head -n 1 return 0 fi ``` No cryptographic checksum or signature is verified before the downloaded files are installed and subsequently executed. ### Technical Analysis Piping an HTTP response directly into Bash creates a remote code-execution channel whose effective payload is determined at installation time rather than audit time. TLS protects transport under ordinary conditions, but it does not protect against repository compromise, account compromise, malicious ref replacement, hosting-platform compromise, or an incorrect repository override. The versioned documentation URL reduces exposure to ordinary branch changes, but it does not provide cryptographic integrity verification. The unpinned `main` example is more dangerous because its contents are explicitly mutable. In addition, `CLAUDE_DELEGATE_REPO` and `CLAUDE_DELEGATE_VERSION` can redirect the archive retrieval behavior. ### Attac ...[truncated 1025 chars]

Remediation

View remediation

" "claude-delegate-v0.2.6.tar.gz" | sha256sum -c - tar -xzf claude-delegate-v0.2.6.tar.gz cd openclaw-claude-delegate-0.2.6 less install.sh bash install.sh ``` 4. Verify the downloaded archive inside `install.sh` before extraction. 5. Reject mutable refs such as `main` in production installation paths. 6. Document that installation should be performed as an unprivileged account. 7. If repository overrides remain supported, require an explicit opt-in and a corresponding trusted checksum or signature. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cc-orchestrator.sh:217

Finding

Caller-Controlled Notification Command Is Executed Through a Shell

Content

View full analysis

&2; exit 1 ;; esac done ``` The value is saved in the task registry and later executed as shell source: ```bash run_notify_hook() { local task_id="$1" local reg_file="$REGISTRY_DIR/${task_id}.json" [ -f "$reg_file" ] || return 0 local notify_cmd status result_preview cost expected_file expected_exists expected_bytes verified next_action continuation_mode session_id notify_cmd=$(python3 -c "import json; print(json.load(open('$reg_file')).get('notify_cmd',''))" 2>/dev/null || true) [ -n "$notify_cmd" ] || return 0 status=$(python3 -c "import json; print(json.load(open('$reg_file')).get('status',''))" 2>/dev/null || true) result_preview=$(python3 -c "import json; print(json.load(open('$reg_file')).get('result_preview',''))" 2>/dev/null || true) cost=$(python3 -c "import json; print(json.load(open('$reg_file')).get('cost_usd',0))" 2>/dev/null || true) expected_file=$(python3 -c "import json; print(json.load(open('$reg_file')).get('expected_file',''))" 2>/dev/null || true) expected_exists=$(python3 -c "import json; print(json.load(open('$reg_file')).get('expected_f ...[truncated 2835 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/ensure-nonroot-delegation.sh:57

Finding

Root Claude Credentials Are Replicated Into a Less-Privileged Runner Account

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/ensure-nonroot-delegation.sh:74

Finding

Delegation Setup Automatically Installs an npm Package Without Verified Integrity

Content

View full analysis

/dev/null 2>&1 fi printf '%s\n%s\n%s\n' "$spec" "$label" "$bin_path" } ``` The fallback dependency specification is: ```bash DEFAULT_ACPX_SPEC="${DEFAULT_ACPX_SPEC:-0.5.3}" ``` ### Technical Analysis The setup routine invokes `npm install` during delegation initialization when the expected binary is absent. No project lockfile or locally verified integrity value is used in this installation path. npm packages may include lifecycle scripts that execute during installation, so dependency compromise can become code execution under the runner account. A fixed fallback version is safer than an unpinned latest version, but a version number alone does not cryptographically establish package integrity. The dependency specification may also be obtained from a host package file or overridden through environment configuration. ### Attack Path 1. Delegation setup runs and determines that the runner-local `acpx` binary is absent. 2. The script resolves a package specification from the OpenClaw package metadata, an environment override, or fallback version `0.5.3`. 3. It invokes npm to download and install the package. 4. A compromised registry account, package release, configured npm registry, or dependency tree supplies malicious package c ...[truncated 517 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/claude-delegate.sh:14

Finding

Delegated Claude Tasks Bypass Permission Controls by Default and Can Access the Entire Home Directory

Content

View full analysis

/dev/null || true)}" fi export CLAUDE_PERMISSION_MODE="${CLAUDE_PERMISSION_MODE:-bypassPermissions}" ``` The ACPX backend similarly approves operations automatically: ```bash local -a session_cmd=("${RUNNER_PREFIX[@]}" "$DELEGATE_ACPX_BIN" --cwd "$workdir" --approve-all --non-interactive-permissions fail --auth-policy skip claude sessions show "$session_name") if ! "${session_cmd[@]}" >/dev/null 2>&1; then "${RUNNER_PREFIX[@]}" "$DELEGATE_ACPX_BIN" --cwd "$workdir" --approve-all --non-interactive-permissions fail --auth-policy skip claude sessions new --name "$session_name" >/dev/null 2>> "$stderr_file" fi local -a cmd=("${RUNNER_PREFIX[@]}" "$DELEGATE_ACPX_BIN" --cwd "$workdir" --approve-all --non-interactive-permissions fail --auth-policy skip --format quiet) ``` The packaged workspace profile exposes the full home directory: ```json "workspace": { "workdir": "${HOME}", "add_dirs": [ "${HOME}" ], "notes": "Generic home-workspace profile. Edit this for your real project roots or point CLAUDE_DELEGATE_PROFILES at a host-local file." } ``` ### Technical Analysis A delegated coding model legitimately needs access to a selected project directory, but it does not ordinarily require automatic approval of all tool operations or access to t ...[truncated 1645 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (59)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an operational worker/delegation lane that exposes Claude access to OpenClaw agents with lifecycle actions like dispatch, poll, result, and resume. The actual code chunk does not implement any of that behavior. Instead, it acts as a command-line installer entrypoint that runs install.sh, shows help, or rejects unknown commands. This is a materially different primary purpose from the declared runtime delegation capability, so the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a stable local Claude delegation lane integrated with OpenClaw, including operational capabilities like dispatch, polling, results, resume, and optional permission bypass execution. The supplied code does none of that. It only scans the provided working directory and optional extra roots (plus ancestors) for a configurable delegate doc basename and common workspace docs, then either lists discovered delegate docs or emits bootstrap instructions telling the model to read them. While filesystem scanning for coordination docs could be a supporting detail in a larger delegation system, this chunk’s actual primary behavior is documentation discovery and prompt generation, which is materially different from the declared transport/worker-lane functionality. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

- Orchestrator: `scripts/cc-orchestrator.sh`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 27)May include surrounding context.

sh

--bin-dir <dir>      Create CLI symlink in this directory (default: ~/.local/bin)
  --link-name <name>   CLI command name to create (default: claude-delegate)
  --no-link            Skip creating the global CLI symlink
  --no-check           Skip post-install setup check
  --smoke              Run a live scratch dispatch smoke test after install
  --force              Replace an existing install (backs it up first)
  --version <ref>      Install from GitHub ref when bootstrapping remotely (default: main)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 51)May include surrounding context.

sh

--bin-dir <dir>      Create CLI symlink in this directory (default: ~/.local/bin)
  --link-name <name>   CLI command name to create (default: claude-delegate)
  --no-link            Skip creating the global CLI symlink
  --no-check           Skip post-install setup check
  --smoke              Run a live scratch dispatch smoke test after install
  --force              Replace an existing install (backs it up first)
  --version <ref>      Install from GitHub ref when bootstrapping remotely (default: main)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The documented '| bash' chaining pattern directly connects network retrieval to shell execution, eliminating opportunities for inspection and making exploitation straightforward if the remote content is modified. In the context of an installer that writes files and creates executable links, this chaining materially amplifies the blast radius of any upstream compromise.

Content

Scanner excerpt · install.sh (reported line 37)May include surrounding context.

sh

bash install.sh
  bash install.sh --force
  bash install.sh --smoke
  curl -fsSL https://raw.githubusercontent.com/$REPO_SLUG/main/install.sh | bash
USAGE
}

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The notify hook executes attacker-controlled shell through bash -lc "$notify_cmd", making any caller able to supply --notify-cmd effectively gain arbitrary command execution in the orchestrator's context. In this skill, that is especially dangerous because the orchestrator already handles task outputs, file paths, and session metadata, so a malicious task or user input can chain into local code execution and data exfiltration.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script writes and deletes /tmp/cc-poll-${task_id}.json using an unsanitized task_id, allowing path traversal or arbitrary file clobber/delete if a crafted task ID containing / is supplied to poll. Since task IDs are accepted from user input in cmd_poll, an attacker can target files outside the intended temp path, especially because the script runs rm -f on that constructed path.

Content

Scanner excerpt · scripts/cc-orchestrator.sh (reported line 389)May include surrounding context.

sh

pass
print(json.dumps(d, indent=2))
PY
  rm -f "/tmp/cc-poll-${task_id}.json"
}

cmd_watch() {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The script is explicitly designed to access a root-owned credential file path, indicating credential handling across a privilege boundary. In the context of a delegation skill, this makes the finding more dangerous because the whole purpose is to let another local account act using root's Claude authentication state.

Content

Scanner excerpt · scripts/ensure-nonroot-delegation.sh (reported line 10)May include surrounding context.

sh

OPENCLAW_ACPX_PACKAGE="${OPENCLAW_ACPX_PACKAGE:-/usr/lib/node_modules/openclaw/dist/extensions/acpx/package.json}"
ROOT_CLAUDE_LINK="${ROOT_CLAUDE_LINK:-/root/.local/bin/claude}"
ROOT_CLAUDE_CREDS="${ROOT_CLAUDE_CREDS:-/root/.claude/.credentials.json}"
ROOT_ACPX_CONFIG="${ROOT_ACPX_CONFIG:-/root/.acpx/config.json}"
DEFAULT_ACPX_SPEC="${DEFAULT_ACPX_SPEC:-0.5.3}"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This function prepares a non-root user's Claude directory specifically to receive root's credential file, enabling credential transfer and reuse. If the runner account is compromised, the attacker gains the delegated Claude identity and any capabilities tied to that auth.

Content

Scanner excerpt · scripts/ensure-nonroot-delegation.sh (reported line 60)May include surrounding context.

sh

sync_claude_auth() {
  install -d -o "$RUNNER_USER" -g "$RUNNER_USER" "$RUNNER_HOME/.claude"
  if [ -f "$ROOT_CLAUDE_CREDS" ]; then
    cp "$ROOT_CLAUDE_CREDS" "$RUNNER_HOME/.claude/.credentials.json"
    chown "$RUNNER_USER:$RUNNER_USER" "$RUNNER_HOME/.claude/.credentials.json"
    chmod 600 "$RUNNER_HOME/.claude/.credentials.json"
  fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The cp command actively copies the root Claude credentials into the runner account, creating a second copy of sensitive authentication material and broadening the attack surface. This can enable unauthorized use, persistence, and difficulty revoking access because multiple principals now hold the same secret.

Content

Scanner excerpt · scripts/ensure-nonroot-delegation.sh (reported line 61)May include surrounding context.

sh

install -d -o "$RUNNER_USER" -g "$RUNNER_USER" "$RUNNER_HOME/.claude"
  if [ -f "$ROOT_CLAUDE_CREDS" ]; then
    cp "$ROOT_CLAUDE_CREDS" "$RUNNER_HOME/.claude/.credentials.json"
    chown "$RUNNER_USER:$RUNNER_USER" "$RUNNER_HOME/.claude/.credentials.json"
    chmod 600 "$RUNNER_HOME/.claude/.credentials.json"
  fi
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Although this line only changes ownership/permissions on the copied credentials, in context it finalizes transfer of root-derived authentication material to another user. That legitimizes and operationalizes the cross-account credential exposure, making misuse by the runner account straightforward.

Content

Scanner excerpt · scripts/ensure-nonroot-delegation.sh (reported line 62)May include surrounding context.

sh

if [ -f "$ROOT_CLAUDE_CREDS" ]; then
    cp "$ROOT_CLAUDE_CREDS" "$RUNNER_HOME/.claude/.credentials.json"
    chown "$RUNNER_USER:$RUNNER_USER" "$RUNNER_HOME/.claude/.credentials.json"
    chmod 600 "$RUNNER_HOME/.claude/.credentials.json"
  fi
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The launch pack recommends a classic curl | bash installation flow that executes remotely fetched code directly in the user's shell without any verification, review step, or warning. That creates a supply-chain and social-engineering risk: if the hosted script, GitHub account, tag, or transport path is compromised, users may execute arbitrary code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This promotional section repeats the remote script execution pattern in a social/distribution context, which increases the chance that users will copy-paste and run it without scrutiny. The danger is not just external fetching but immediate execution of unreviewed code from a remote source, enabling arbitrary code execution if that source is tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The forum/listing instructions again encourage direct execution of downloaded code with no warning, normalizing unsafe installation behavior across user-facing channels. Repetition across marketing surfaces broadens exposure and increases the blast radius of any compromise of the referenced install script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README describes syncing Claude auth into a runner home and forwarding OAuth tokens to another execution context without clearly warning users about credential handling risks. This can expose secrets to another account, broaden token access, and make compromise of the runner equivalent to compromise of the primary Claude account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation instructs users to pipe a remote script directly into bash, which executes arbitrary network-fetched code immediately. In this skill's context, the installer also sets up local executables and interacts with runner/OAuth environment state, so a compromised script or transport path could lead to code execution and credential exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

md

That will:
- install the skill into `~/.agents/skills/claude-delegate` by default
- create `~/.local/bin/claude-delegate`
- run a setup check against the same runner/OAuth environment the wrapper uses
- include the repo's default `CLAUDE.delegate.md` guidance in the installed package

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README recommends running the package via npx without pinning a specific version. That allows execution of whatever version is currently published under that package name, creating a supply-chain risk if a malicious or compromised release is pushed later.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx openclaw-claude-delegate executes code fetched from the registry without an explicit pinned version. In a security-sensitive skill that handles OAuth tokens and optional privilege transitions, unpinned package execution increases the blast radius of a package compromise or malicious republish.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The wrapper's documented behavior changes when run as root and automatically forwards OAuth material into a runner environment. Root-context execution combined with implicit credential propagation increases the chance of accidental over-privilege, secret leakage, or unsafe file ownership/permission side effects.

Content

Scanner excerpt · README.md (reported line 208)May include surrounding context.

md

The wrapper is adaptive:

- if run as root and `/home/ccbot` exists, it defaults to a `ccbot` runner;
- otherwise it runs as the current user with the current `claude` binary;
- if `CLAUDE_OAUTH_ENV_FILE` exists, it is sourced and `CLAUDE_CODE_OAUTH_TOKEN` is forwarded into the runner environment.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 233)May include surrounding context.

md

For the full non-root self-heal path, you also want:
- npm
- sudo and permission to switch to the runner user
- a runner user such as `ccbot`

## Important reality checks

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises shell-driven delegation wrappers and references filesystem reads/writes, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent ecosystem, missing scope metadata can cause the skill to run with broader capabilities than reviewers or orchestrators expect, increasing the chance of unintended command execution or file access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bin/openclaw-claude-delegate.js:10