Claude Code Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:17 PM UTC
• Version: 1.0.0

Overview

This looks like a documentation helper rather than malware, but it needs Review because it overstates automation and includes unsafe command examples users might run.

Install only if you want a lightweight offline Claude Code documentation helper. Treat the task/subagent features as guidance rather than real automation, review any command before running it, do not pipe remote installers directly into a shell, and do not add the filesystem MCP example unless you pin and verify the package and restrict its file access.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: claude-code.py:26

Finding

Unverified Remote Installation Scripts Piped Directly to Shell Interpreters

Content

View full analysis

Vulnerability Details

File Location: claude-code.py, lines 26-33
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

python

### macOS/Linux (curl):
```bash
curl -fsSL https://claude.ai/install.sh | bash

Windows (PowerShell):

powershell

irm https://claude.ai/install.ps1 | iex

text

### Technical Analysis

The embedded quickstart documentation instructs users or an AI agent to download scripts from remote URLs and immediately pass their contents to `bash` or PowerShell's `Invoke-Expression`. The downloaded payload is not pinned to an immutable version and is not inspected or verified using a cryptographic signature or checksum before execution.

Although the URLs use HTTPS and appear to belong to the expected vendor, HTTPS only protects the connection in transit. It does not protect against compromise of the vendor endpoint, DNS or certificate infrastructure, deployment pipeline, or upstream account. The effective code executed by these commands can also change after this Skill has been reviewed.

The local Python implementation only displays these commands and does not automatically execute them. Exploitation therefore depends on a user or agent following the displayed installation instructions.

### Attack Path

1. A user or agent invokes `claude-code query quickstart`.
2. The Skill displays the `curl | bash` or `irm | iex` installation command.
3. The user or agent executes the suggested command.
4. The remote endpoint returns a script that has changed since the Skill was audited, whether through legitimate updates or compromise.
5. The shell interpreter immediately executes the response without inspection or integrity verification.
6. A malicious response can perform arbitrary actions permitted to the invoking account.

### Impact Assessment

A compromised remote script would obtain arbitrary command execution with the privileg
...[truncated 467 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove direct curl | bash and irm | iex pipelines from the embedded documentation.
2. Prefer linking users to the vendor's official installation documentation without automatically proposing executable shell pipelines.
3. If command-line installation guidance is required, separate download and execution:
   • Download the installer to a local file.
   • Pin an immutable release version.
   • Verify a vendor-published cryptographic signature or SHA-256 checksum.
   • Allow the user to inspect the downloaded file.
   • Execute it only after explicit confirmation.
4. Document the expected filesystem changes, network destinations, and required privileges before execution.
5. Avoid running the installer as root or through sudo unless a specific operation demonstrably requires elevation.
6. Update both Unix and Windows instructions so they provide equivalent verification and review safeguards.

T08 · Insecure Dependencies

Error

• Location: claude-code.py:510

Finding

Unpinned Package Automatically Retrieved and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: claude-code.py, lines 510-521
Vulnerability Type: Insecure third-party dependency execution
Risk Level: High

Vulnerable Code

python

## Configuration

Configure MCP in `~/.claude/mcp.json`:
```json
{
  "servers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@anthropic-ai/filesystem-mcp"]
    }
  }
}

text

### Technical Analysis

The suggested MCP configuration launches an unpinned package through `npx -y`. The `-y` option suppresses the normal installation confirmation, while the absence of an exact package version allows registry-controlled package contents to change after the Skill has been audited.

Package installation and execution can invoke package lifecycle or runtime code with the invoking user's permissions. The proposed component is also intended to provide filesystem capabilities, increasing the potential scope of compromise if the package name is incorrect, becomes compromised, or resolves to an unexpected artifact.

This configuration is presented as static documentation; the audited Python code does not write `~/.claude/mcp.json`, invoke `npx`, or read Claude credentials automatically. Exploitation requires a user or agent to adopt the displayed configuration. The dependency is not necessary for the Skill's implemented local documentation-query functionality.

### Attack Path

1. A user or agent requests the MCP documentation from the Skill.
2. The Skill recommends adding the displayed server definition to `~/.claude/mcp.json`.
3. Claude Code processes the configuration and launches `npx -y @anthropic-ai/filesystem-mcp`.
4. `npx` resolves and downloads the current registry package without requiring installation confirmation.
5. A compromised, replaced, or otherwise unsafe package executes with the user's privileges.
6. The package can access resources available to its process and may receive filesystem c
...[truncated 629 chars]

Remediation

View remediation

Remediation Suggestions

1. Confirm the correct, officially maintained MCP package name before recommending it.
2. Pin the dependency to an exact reviewed version rather than resolving the latest registry release.
3. Use a lockfile or equivalent integrity metadata and verify the package's registry integrity hash.
4. Remove -y so installation requires explicit user confirmation and the resolved package information can be reviewed.
5. Prefer a separately installed, verified executable over automatic package retrieval each time the MCP server starts.
6. Restrict the filesystem server to explicitly approved project directories rather than the user's home directory or unrestricted filesystem roots.
7. Run the server with a dedicated low-privilege account or sandbox where feasible, with unnecessary network and filesystem permissions disabled.
8. Document package provenance, version-update procedures, expected permissions, and incident-response steps for dependency compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (20)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

claude-code task -d "Refactor database" -p high

With specific model

claude-code task -d "Implement API" -m claude-3-5-sonnet

text

### ℹ️ info - Show Configuration

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill claims it can query live external docs, manage subagents, and execute coding workflows, but the described implementation does not actually perform those actions. This mismatch is dangerous because users and orchestrating agents may trust the skill with sensitive development tasks under false assumptions, leading to unsafe delegation, incorrect approvals, or policy bypass through misleading capability claims.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

bash

# Create a coding subagent for a complex task
claude-code task --description "Fix the login bug" --priority high
claude-code task --description "Refactor the database layer" --model claude-3-5-sonnet

List Available Commands

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

bash

claude-code task --description "Implement user authentication module"
claude-code task --description "Refactor database queries" --priority high
claude-code task --description "Write unit tests for the API" --model claude-3-5-sonnet

docs

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The documentation includes curl -fsSL https://claude.ai/install.sh | bash, which is a classic unsafe pattern for fetching and immediately executing remote code. In a coding-assistant skill, users may copy or agents may reuse this command, creating a realistic path to arbitrary code execution if the remote source is compromised or intercepted.

Content

Scanner excerpt · claude-code.py (reported line 28)May include surrounding context.

python

### macOS/Linux (curl):
```bash
curl -fsSL https://claude.ai/install.sh | bash
```

### Windows (PowerShell):

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The | bash construct is dangerous because it chains network retrieval directly into command execution with no review step. Within an agent skill that provides coding workflows and documentation, this increases the chance of unsafe command propagation and blind execution by users or automation.

Content

Scanner excerpt · claude-code.py (reported line 28)May include surrounding context.

python

### macOS/Linux (curl):
```bash
curl -fsSL https://claude.ai/install.sh | bash
```

### Windows (PowerShell):

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · claude-code.py (reported line 192)May include surrounding context.

python

### Configuration Files
- `~/.claude/` - Main config directory
- `~/.claude/settings.json` - User settings
- `CLAUDE.md` - Project-specific instructions

## Common Settings

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · claude-code.py (reported line 252)May include surrounding context.

python

### ⚠️ "Memory issues"
**Solutions:**
- Clear conversation history
- Reduce batch sizes
- Restart Claude Code session

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · claude-code.py (reported line 280)May include surrounding context.

python

### Token Limits
- Break large tasks into smaller steps
- Use summary contexts
- Clear history periodically

## Getting Help

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · claude-code.py (reported line 338)May include surrounding context.

python

### With Model Selection
```bash
/subagent --name complex-analysis --model claude-3-5-sonnet --description "Deep code analysis"
```

## Best Practices

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · claude-code.py (reported line 514)May include surrounding context.

python

## Configuration

Configure MCP in `~/.claude/mcp.json`:
```json
{
  "servers": {

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

Manual Install

bash

# Create skill directory
mkdir -p ~/.openclaw/skills/claude-code

# Copy files

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises shell-adjacent/code-execution capabilities and task automation, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing tool constraints can cause the runtime or downstream agent to invoke broader tools than users expect, increasing the chance of unintended command execution or file changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation guidance is broad enough to match generic coding requests, not just narrowly scoped Claude Code integration tasks. Over-broad routing increases the chance that this skill is invoked in situations involving source modification, automation, or model/task delegation without the user intending to use this specific integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown encourages task execution, code execution, and file-management workflows but does not warn that these actions may modify the codebase or trigger automated behavior. In agent-driven environments, omission of such warnings can lead users to approve actions without understanding that files, repositories, or reviews could be changed programmatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The embedded documentation instructs users to install software by piping a remote script directly into a shell (curl ... | bash and PowerShell iex). In an agent skill, presenting such commands without a warning normalizes unsafe execution and can lead to arbitrary code execution if users or downstream agents follow the instructions blindly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · claude-code.py (reported line 99)May include surrounding context.

python

- Maintain coding standards

### Testing
- Always write tests for AI-generated code
- Test edge cases
- Verify boundary conditions

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest says the skill can manage subagents, execute AI-assisted coding workflows, and handle complex programming tasks. The only related implementation is a stubbed 'task' command that echoes user input and tells the user to use OpenClaw's native tools directly, so the advertised capabilities are not actually implemented here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown recommends executing openclaw exec "git pull origin main", which runs a system-affecting command that modifies the local repository state. The surrounding documentation does not include any warning about reviewing the command first, ensuring a clean working tree, or understanding that it will change local files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes querying Claude Code documentation from an external site, which implies live or source-backed retrieval. In this file, documentation is embedded in a static in-memory dictionary and all query behavior operates only on that local cache, so the implemented behavior is materially narrower than claimed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.