ClawHub
Back to skill

Security audit

coding-agent

Security checks for vulnerabilities and agentic risk

Overview

The verdict is suspicious because a scanner reports that the skill launches Claude Code with permission checks bypassed without warning, creating a significant permissions risk.

Consider the permission-bypass concern carefully before installing. The scan is partial: it inspected the listed Markdown component, but two local path-like references could not be resolved, so the evidence is incomplete and does not establish that the artifact is safe.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Claude Code is launched with permission checks bypassed without warning the user about the implications.

High
Category
Output Handling
Confidence
98% confidence
Finding

The skill mandates launching Claude Code with --permission-mode bypassPermissions, removing permission approval checks without warning the user or requiring explicit consent. Trusted-ref checks and isolated Git worktrees reduce some risks, but a worktree is not a security sandbox: a mistaken or prompt-injected worker could execute commands, access host credentials, or modify files outside the checkout with the launching user's privileges.

Content

No source excerpt is available for this finding.