claude-delegate

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 0.1.0

Overview

The skill is transparent about delegating work to Claude Code, but it exposes high-impact permission-bypass and write-capable modes without an enforced approval gate.

Install only in trusted local environments. Use read-only mode by default, use workspace-write only for intended edits, avoid sending secrets or production data in prompts, stdin, logs, or repository context, and do not expose danger-full-access or bypassPermissions to untrusted users or automation without an external approval and isolation control.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/claude-delegate.sh:128

Finding

Unenforced Unrestricted Execution Mode

Content

View full analysis

Vulnerability Details

File Location: scripts/claude-delegate.sh, lines 84-87, 128-145, and 192-195
Vulnerability Type: Unrestricted permission bypass without independently verified operator approval
Risk Level: High

Vulnerable Code

bash

    --permission-mode)
      permission_mode="${2:?--permission-mode requires a mode}"
      shift 2
      ;;

bash

if [[ -n "$permission_mode" ]]; then
  case "$permission_mode" in
    plan|acceptEdits|dontAsk|auto|bypassPermissions) ;;
    *)
      echo "--permission-mode must be plan, acceptEdits, dontAsk, auto, or bypassPermissions" >&2
      exit 2
      ;;
  esac
else
  case "$sandbox" in
    read-only) permission_mode="plan" ;;
    workspace-write) permission_mode="acceptEdits" ;;
    danger-full-access) permission_mode="bypassPermissions" ;;
  esac
fi

bash

if [[ "$permission_mode" == "bypassPermissions" ]]; then
  # Make the bypass option available (recommended only for isolated sandboxes).
  cmd+=(--allow-dangerously-skip-permissions)
fi

Technical Analysis

The wrapper accepts bypassPermissions directly through --permission-mode and also maps --sandbox danger-full-access to that mode. It then supplies --allow-dangerously-skip-permissions to Claude Code.

Although SKILL.md states that unrestricted mode should only be used on an isolated machine or container with explicit operator approval, the script does not enforce either condition. There is no trusted approval gate, environment isolation check, interactive confirmation, policy file, or caller authorization check before permission controls are disabled.

Consequently, any caller able to influence the wrapper arguments can convert a delegated, prompt-driven task into unrestricted tool execution under the operating-system account running the wrapper. The supported --add-dir option can further broaden the filesystem scope presented to Clau ...[truncated 1990 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove bypassPermissions and danger-full-access from the skill-facing interface unless unrestricted execution is an essential requirement.
2. Reject direct --permission-mode bypassPermissions overrides by default.
3. If unrestricted execution must remain available, require an independently verified, operator-controlled opt-in that cannot be supplied by delegated prompt content or ordinary skill arguments.
4. Add a trusted policy configuration outside the delegated workspace that identifies whether unrestricted execution is permitted.
5. Require an interactive confirmation through a trusted terminal, or a short-lived authorization token generated outside the agent-controlled context.
6. Run all unrestricted or write-capable tasks inside an isolated container or disposable virtual machine with:
   • A narrowly mounted workspace.
   • No host credential directories.
   • A non-privileged user.
   • Read-only system mounts.
   • Restricted or disabled network access.
   • Resource and execution time limits.
7. Canonicalize and validate every --add-dir path against an operator-approved allowlist. Reject paths outside approved workspace roots and prevent symlink-based escapes.
8. Keep plan mode as the default and permit acceptEdits only for tasks that explicitly require modifications.
9. Record security-relevant invocations, including permission mode, approved directories, caller identity, and approval source, while excluding prompts or data that may contain secrets.
10. Treat prompts and repository contents as untrusted input and ensure they cannot change the authorization mode selected by the trusted orchestration layer.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 17)May include surrounding context.

md

- Prompt file and stdin-file support
- Tool allowlist (`--allowed-tools`) and model selection (`--model`)
- Enterprise-friendly: uses saved OAuth login, no API key required
- Comprehensive safety rules (no API key passthrough, no credentials.json access)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

md

- Prompt file and stdin-file support
- Tool allowlist (`--allowed-tools`) and model selection (`--model`)
- Enterprise-friendly: uses saved OAuth login, no API key required
- Comprehensive safety rules (no API key passthrough, no credentials.json access)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- Prompt file and stdin-file support
- Tool allowlist (`--allowed-tools`) and model selection (`--model`)
- Enterprise-friendly: uses saved OAuth login, no API key required
- Comprehensive safety rules (no API key passthrough, no credentials.json access)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

- Prompt file and stdin-file support
- Tool allowlist (`--allowed-tools`) and model selection (`--model`)
- Enterprise-friendly: uses saved OAuth login, no API key required
- Comprehensive safety rules (no API key passthrough, no credentials.json access)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- `claude` (Claude Code CLI) is installed on `PATH`.
- Claude CLI has already been authenticated by the operator with `claude auth login` (browser OAuth — works for Pro, Max, and Enterprise accounts). **No API key is required or used.** Enterprise accounts sign in with their org credentials/SSO; some orgs route through a corporate gateway (`claude gateway --config`), which the CLI handles automatically once configured.
- Do not ask the user for an API key.
- Run inside the target repository or pass `--cwd`.
- OpenClaw must allow this agent to use `exec` for the wrapper script.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The skill delegates repository context and command output to a separately authenticated local Claude CLI session, which creates a cross-agent/session data flow and persistence risk. Piping test output or repository content into another agent can unintentionally disclose sensitive code, tokens in logs, or proprietary data to an external service, especially when using workspace-write mode and saved OAuth credentials.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

bash

npm test 2>&1 | {baseDir}/scripts/claude-delegate.sh \
  --cwd /path/to/repo \
  --sandbox workspace-write \
  --prompt "Summarize the failing tests and make the smallest safe fix."

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script enables Claude's permission bypass mode by appending --allow-dangerously-skip-permissions whenever --permission-mode resolves to bypassPermissions. While this is an explicit feature, it materially weakens safety boundaries and there is no runtime confirmation, warning banner, or environment gating before invoking a highly privileged local coding agent. In this skill's context—delegating repository analysis, edits, and command execution to a local CLI—this increases the chance that untrusted prompts or repository content could trigger destructive local actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.