ClawHub
Back to skill

Security audit

claude-delegate

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently delegates user-directed coding tasks to a local Claude Code CLI, with expected but important risks around repository access, edits, and optional local logging.

Install only in trusted local workspaces. Start with read-only mode, use workspace-write only for intended edits, reserve danger-full-access for isolated environments, and avoid --json-log unless you are comfortable storing potentially sensitive prompts, repository snippets, tool output, and responses on disk.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The README advertises broad conversational triggers like "use Claude Code" or "delegate to Claude" that could cause the host agent to invoke this skill when a user did not intend a privileged delegation action. Because this skill can route tasks to a local authenticated CLI capable of reading repositories, editing files, and running commands, accidental invocation materially increases the chance of unintended code changes or data exposure.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
When --json-log is used, the script writes Claude's full stream-json event output to a user-specified file. Those events can include prompts, repository content, tool outputs, and model responses, so sensitive data may be persisted to disk without any explicit warning, redaction, or permission tightening. In this skill's context, that is more dangerous because the wrapper is specifically designed for repository analysis and code/task delegation, which commonly involves proprietary source, secrets, or internal context.

Static analysis

No suspicious patterns detected.