Security audit

Shark

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent async-agent purpose, but it grants broad background execution and permission-bypassed Claude runs without enough user control or containment.

Install only if you explicitly want an agent to spawn subagents, run long shell commands in the background, and manage recurring pollers. Avoid the bundled shark.sh unless you remove the Claude permission-bypass flag or run it in a sandbox. Review and pin any remote install source, keep state files private, and do not use this with commands or logs that may contain secrets.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: shark.sh:69
Finding: Claude Is Executed with Permission Checks Disabled
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: shark.sh:45
Finding: Mutable State Is Injected Directly into a Privileged Agent Prompt
Content: View full analysis
5s), use shark-exec pattern." echo "Write TASK_COMPLETE to a file named .shark-done when finished." echo "Write progress to SHARK_LOG.md after each loop." } ``` ### Technical Analysis The script concatenates the complete contents of `shark-exec/state/pending.json` directly into the agent prompt. Fields such as job labels and command strings may originate from users, prior agent activity, shell commands, or other processes. The data is not parsed into a validated schema, encoded, delimited as untrusted content, or accompanied by a strong instruction that it must never be treated as executable guidance. Instruction-like text placed in any state field can therefore compete with the legitimate prompt. The task itself is also inserted verbatim. This is especially severe in combination with the permission bypass in `shark.sh`, because successful prompt injection can be converted directly into unrestricted host actions. ### Attack Path 1. An attacker or compromised process modifies `shark-exec/state/pending.json`. 2. The attacker places instruction-like text in a field such as `label` or `command`. 3. On the next iteration, `build_prompt` copies the entire file into the model prompt. 4. The model treats the malicious text as an instruction rat ...[truncated 700 chars]
Remediation: View remediation

T06 · System Persistence

Warning

Location: shark-exec/SKILL.md:87
Finding: Background Pollers May Persist Beyond the Initiating Skill Run
Content: View full analysis
/skills/shark/shark-exec/state/pending.json for pending background jobs. For each entry: call process(action=poll, sessionId=X, timeout=3000). If completed, send the result to and remove the entry from pending.json. If still running and startedAt + maxSeconds*1000 < Date.now(), kill it with process(action=kill, sessionId=X) and send partial output with '⏱ killed after Xs'. After processing all entries, if pending.json jobs array is empty, delete this cron job (cronJobId is stored in the state file under cronJobId field)." }, "sessionTarget": "isolated", "delivery": {"mode": "none"} } ``` Once you have the poller/cron ID, **immediately update the state file** to store it: ```json { "sessionId": "sess-abc-123", ..., "cronJobId": "the-cron-id-returned" } ``` ``` The runtime adapter section also recommends persistent operating-system mechanisms: ```markdown ### Claude Code / claude --print - Schedule: not native — use a wrapper script or OS cron ### Codex (openai/gpt-5-codex) - Schedule: OS cron or a watcher script ### Cursor / Windsurf / Aider - Schedule: OS-level cron or task scheduler ``` ### Technical Analysis The skill directs agents to create recurring scheduled jobs that execute every 15 seconds. In some supported environments, it explicitly recommends OS cron or a task scheduler, which can survive the initiating agent ses ...[truncated 1576 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: README.md:133
Finding: Installation Instructions Retrieve Mutable, Unverified Remote Content
Content: View full analysis
> .gitignore ``` ### Claude Code ```sh # Install as a skill (full repo with shark-exec) mkdir -p ~/.claude/skills git clone https://github.com/keugenek/shark-pattern ~/.claude/skills/shark ``` Or drop just the SKILL.md: ```bash curl -o SHARK.md https://raw.githubusercontent.com/keugenek/shark-pattern/main/SKILL.md ``` ``` Additional installation examples repeat the same mutable retrieval pattern: ```markdown ### Gemini CLI ```bash curl -o SHARK.md https://raw.githubusercontent.com/keugenek/shark-pattern/main/SKILL.md gemini --system-prompt SHARK.md -p "your task" ``` ### Cursor / Windsurf ```bash curl -o .cursor/rules/shark.md \ https://raw.githubusercontent.com/keugenek/shark-pattern/main/SKILL.md ``` ### Aider ```bash curl -o SHARK.md https://raw.githubusercontent.com/keugenek/shark-pattern/main/SKILL.md aider --read SHARK.md ``` ``` The promotional installation guidance also uses an unpinned package invocation: ```bash npx clawhub@latest install shark ``` ### Technical Analysis The documented installation paths retrieve content from the mutable `main` branch without pinning a release tag or commit hash and without verifying a signature or checksum. The resulting Markdown is then loaded as a system prompt, agent rule, or skill instruction file. Although the retrieved artifact is textual, agent instruction files are executable in effect: they can direct tool use, shell execution, network activity, and data access. Upstream changes after this audit can therefore alter the skill's effective behavior without any local code change. The ` ...[truncated 1308 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: shark-exec/SKILL.md:58
Finding: Full Commands and Process Output Are Persisted and Forwarded Without Redaction
Content: View full analysis
/skills/shark/shark-exec/state/pending.json`. If it doesn't exist, start with `{"jobs": []}`. Append your new job: ```json { "jobs": [ { "sessionId": "sess-abc-123", "label": "CI: run #12345", "command": "gh run watch 12345", "startedAt": 1710000000000, "maxSeconds": 120, "cronJobId": null } ] } ``` ``` The poller is instructed to transmit process output: ```json { "schedule": {"kind": "every", "everyMs": 15000}, "payload": { "kind": "agentTurn", "message": "Check /skills/shark/shark-exec/state/pending.json for pending background jobs. For each entry: call process(action=poll, sessionId=X, timeout=3000). If completed, send the result to and remove the entry from pending.json. If still running and startedAt + maxSeconds*1000 < Date.now(), kill it with process(action=kill, sessionId=X) and send partial output with '⏱ killed after Xs'. After processing all entries, if pending.json jobs array is empty, delete this cron job (cronJobId is stored in the state file under cronJobId field)." }, "sessionTarget": "isolated", "delivery": {"mode": "none"} } ``` The documented state format retains the command in plaintext: ```json { "jobs": [ { "sessionId": "sess-abc-123", "label": "CI: run #12345", "command": "gh run watch 12345", "startedAt": 1710000000000, "maxSeconds": 120, "cronJobId": "cron-xyz-456" } ] } ``` ### Technical Analysis The skill stores complete command strings in a persistent JSON file and directs a scheduled agent to send completed or partial process output to an unspecified notification channel. Shell commands may contain bearer token ...[truncated 1881 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (17)

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
│ spawn N remoras (+ 1 pilot fish when first completes early) ▼ ┌─────────────┐ │ SPAWN │ sessions_spawn × N, all parallel, record session IDs └──────┬──────┘ │ main agent keeps reasoning (never waits) ▼

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · shark.sh (reported line 69)May include surrounding context.
sh
rm -f "$_timeout_flag" claude --print --permission-mode bypassPermissions < "$_prompt_file" & _claude_pid=$! (

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script invokes claude with --permission-mode bypassPermissions, which disables normal safety/authorization controls while feeding it task text, skill instructions, and pending state that may all be adversarial. In a loop runner, this grants the model repeated unrestricted execution opportunities, making prompt-injection or unsafe tool use materially more dangerous than necessary for the stated purpose.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 145)May include surrounding context.
Claude Code

sh
# Install as a skill (full repo with shark-exec) mkdir -p ~/.claude/skills git clone https://github.com/keugenek/shark-pattern ~/.claude/skills/shark

Add to CLAUDE.md:

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The installation instructions place the skill under a persistent per-user agent skills directory and tell the user to reference it from CLAUDE.md, creating durable behavioral influence across future sessions. In the context of agent skills, persistence increases risk because any unsafe or later-compromised skill content continues affecting subsequent tasks until manually removed.
Content: Scanner excerpt · README.md (reported line 145)May include surrounding context.
Claude Code

sh
# Install as a skill (full repo with shark-exec) mkdir -p ~/.claude/skills git clone https://github.com/keugenek/shark-pattern ~/.claude/skills/shark

Add to CLAUDE.md:

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 151)May include surrounding context.
Add to CLAUDE.md:

markdown
## Execution Model See ~/.claude/skills/shark/SKILL.md — use the Shark Pattern for any multi-step task with slow tools.

Or drop just the SKILL.md:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are very broad natural-language commands such as 'Use shark mode', 'Keep swimming', and 'Never wait for tools'. In agents that auto-load nearby instruction files, these generic phrases can unintentionally activate the skill in unrelated conversations and push the agent into spawning background tasks or changing execution behavior without clear user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill can auto-activate not only on explicit user requests but also when the agent 'notices' it may block on a slow tool. That broad heuristic can cause the agent to change execution mode, spawn subagents, or initiate background work without clear user consent, increasing the chance of unexpected tool use and side effects.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: The skill encourages spawning background workers and maintaining asynchronous state across turns, which creates persistence beyond a single user-visible action. Without strict lifecycle controls and consent boundaries, background agents may continue running, consume resources, or act on stale context after the user no longer expects activity.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
- "use the shark pattern" - "non-blocking agent" - "never wait for tools" - "spawn background workers" - "parallel subagents" - "keep the main agent moving" - or when you notice you're about to block on a slow tool (web fetch, SSH, build, test run, API call)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill normalizes killing or tearing down subprocesses/subagents on timeout or completion without requiring a user-visible warning about interruption, unsaved work, or partial outputs. In practice, this can terminate active tasks abruptly and lead to lost state, incomplete edits, or inconsistent results, especially when external tools or long-running jobs are involved.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The installation command uses npx clawhub@latest install shark, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed version. In a skill-distribution context this creates a supply-chain execution risk: if the package, a dependency, or the distribution account is compromised, users may run attacker-controlled code directly from the promotional instructions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The suggested trigger phrases — such as Use shark mode for this, Non-blocking — spawn where needed, and especially Keep swimming — are broad, natural-language expressions that could appear in normal conversation or unrelated prompts. If the skill system activates on these phrases, the skill may be invoked unintentionally, causing unexpected spawning behavior, altered execution flow, or unsafe tool use in contexts where the user did not explicitly intend to enable this skill.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: The skill is explicitly designed around background execution and persistent polling of shell commands, which increases the risk that untrusted or dangerous commands continue running outside the main interaction flow. Because the pattern encourages session persistence plus scheduled polling and notification, misuse could enable long-lived unauthorized execution, harder-to-audit actions, or persistence of sensitive command output in files and notifications.
Content: Scanner excerpt · shark-exec/SKILL.md (reported line 45)May include surrounding context.
md
This must be the **first thing you do** — before exec, before writing state. Silence = failure. ### Step 2 — Launch Background Process Launch the command in the background using your agent's background execution primitive (see [Runtime Adapters](#runtime-adapters) below).

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill instructs the agent to read and modify a shared state file and elsewhere explicitly says to reset corrupted pending.json to an empty jobs list. That creates a real integrity and availability risk: concurrent jobs, malformed input, or partial writes can cause job loss, orphaned processes, or accidental deletion of tracking state without operator confirmation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The header states each iteration is one bounded Claude turn and 'Never blocks >30s per loop,' yet the script's actual task completion mechanism relies on Claude writing .shark-done and progress files outside the script itself. While the Claude subprocess is timeout-bounded, the documented framing overstates what the script itself guarantees about successful bounded loop behavior and completion semantics.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script executes Claude with bypassed permissions without an explicit warning or informed-consent step for the user. Because the tool is being run on arbitrary task text and skill content, the absence of a clear warning increases the risk that users unknowingly authorize unsafe operations or overtrust the loop wrapper.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The README repeatedly instructs users to fetch remote content with curl and clone a repository into agent skill directories, but it does not warn that this imports unreviewed instructions/code into trusted agent context. In an agent-skill setting, downloaded prompt files can alter model behavior persistently, making this more sensitive than ordinary package installation guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T01 · Skill Instruction Hijacking

T06 · System Persistence

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

SkillSpector

Context Leakage

External Model or Provider Selection

Context-Inappropriate Capability

Skill Enumeration

Claude Code

Session Persistence

Claude Code

Skill Enumeration

Vague Triggers

Vague Triggers

Session Persistence

Missing User Warnings

Rp1

Vague Triggers

Session Persistence

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Static analysis