CHC - Claw Help Claude

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:52 AM UTC
• Version: 1.1.0

Overview

The skill is coherent for managing Claude Code sessions, but it needs review because it installs an unpinned CLI and handles local Claude/acpx configuration and session files with limited safeguards.

Install only if you are comfortable letting this skill manage Claude Code sessions and inspect local Claude configuration/session files. Pin or review the acpx package before installation, avoid using the direct rm troubleshooting step without backing up the config, and treat stored session files as sensitive conversation history.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

--prefix ~/.openclaw/npm ``` - Maintain and distribute a lockfile containing verified dependency versions and integrity hashes. - Verify that the package is obtained from the expected official npm registry and publisher. - Consider installing with `--ignore-scripts` when package lifecycle scripts are not required: ```bash npm install --ignore-scripts --save-exact acpx@ --prefix ~/.openclaw/npm ``` - Review the pinned package and its transitive dependency tree before recommending it. - Document a controlled update process so version changes require a new security review. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/session_manager.py:53

Finding

Path Traversal in Session Status File Lookup

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The explicit use of rm ~/.acpx/config.json is a destructive tool invocation pattern presented as routine troubleshooting. In an agent skill, such guidance is dangerous because an automated or inattentive operator could execute it directly, causing loss of local configuration and potentially disrupting future CLI behavior.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Q: ACP spawn 失效？

检查 ~/.acpx/config.json，删除错误的配置：

bash

rm ~/.acpx/config.json

然后用 npx 默认方式。

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

## 配置文件位置

- `~/.claude/settings.json` - 主配置文件
- `~/.claude/settings.local.json` - 本地覆盖（不共享）
- `~/.claude/sessions/<uuid>.json` - 会话持久化

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/config.md (reported line 5)May include surrounding context.

md

## 配置文件位置

- `~/.claude/settings.json` - 主配置文件
- `~/.claude/settings.local.json` - 本地覆盖（不共享）
- `~/.claude/sessions/<uuid>.json` - 会话持久化

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/config.md (reported line 6)May include surrounding context.

md

## 配置文件位置

- `~/.claude/settings.json` - 主配置文件
- `~/.claude/settings.local.json` - 本地覆盖（不共享）
- `~/.claude/sessions/<uuid>.json` - 会话持久化

## API 认证配置

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation description is overly broad, including generic triggers like mentioning 'claude code' or wanting to use Claude Code through OpenClaw. This can cause the skill to activate in situations beyond the user's explicit intent, leading to unnecessary tool use and unintended session management actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill recommends deleting ~/.acpx/config.json as a troubleshooting step without warning about the destructive effect or suggesting backup/inspection first. Even though the target is a config file rather than arbitrary user data, this normalizes unsafe destructive commands and can erase custom configuration unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The session persistence section explains that messages and tool calls are stored in local session files, but it does not clearly warn that conversation history and potentially sensitive data will be written to disk. This is a genuine security/privacy issue because operators may enable or use session recovery without understanding the local data exposure, backup leakage, or filesystem access implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document recommends forwarding user messages through a PTY bridge but does not warn that message content may transit additional components, be logged, or be exposed to operators of the bridge. This creates a real privacy and data-handling risk because users or deployers may assume a direct agent connection and unknowingly route sensitive conversations through less-trusted infrastructure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config.md (reported line 145)May include surrounding context.

json

{
  "disallowedTools": ["Bash(rm *)", "Bash(sudo *)"]
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The clean operation permanently deletes session JSON files based solely on age, without a confirmation prompt, dry-run mode, or recycle/backup mechanism. A user mistake, unexpected timestamp parsing behavior, or invocation in the wrong context could cause irreversible loss of conversation history and workflow data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Most of the operational instructions and guidance are provided only in Chinese, which effectively imposes a language choice on users who may not use that locale. The policy requires either offering a language/locale choice or clearly documenting and justifying the constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The module docstring frames the tool as '会话管理工具' and the usage text focuses on session listing, status, cleanup, and info. However, the 'info' command implemented later reads ~/.claude/settings.json and displays configuration values such as base URL, token presence, model, and allowed tools, which extends beyond pure session management.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

All user-facing docstrings and CLI messages are presented only in Chinese, with no indication that another language can be selected. This can violate language/locale policy where tools must not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.