Claude CLI Proxy

• Outcome: Review
• Latest audit: May 28, 2026 · 8:47 AM UTC
• Version: 2.1.0

Overview

The skill mostly does what it says, but it needs Review because it creates a persistent local proxy that forwards full OpenClaw context through Claude Code and weakens prompt-boundary transparency.

Install only if you deliberately want OpenClaw prompts, system context, and recent conversation history routed through your Claude Code account. Keep the proxy bound to localhost, avoid storing secrets or broad identity files in persistent configs, use a simple safe session name, review the scripts before enabling autostart, and make sure you know how to stop and remove any LaunchAgent, systemd service, heartbeat entry, and acpx session.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill describes network-facing proxy behavior, environment-variable use, local file writes, and authentication-sensitive routing, yet exposes no declared permissions. That mismatch can prevent proper review and user consent, causing the skill to be invoked with capabilities that are broader than expected. In this context, the proxy handles model traffic and subscription-backed authentication, so undeclared capabilities materially increase risk.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases are broad terms like "free," "$0," "subscription," and "reduce costs," which can cause the skill to activate in many unrelated conversations. Over-broad activation is dangerous here because the skill promotes rerouting requests through a local proxy and changing authentication/model-provider behavior, potentially steering users into risky configuration without explicit intent.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the operator to force a specific agent identity via custom instructions and workspace files without any user opt-in. This can misrepresent the model's identity and provenance, making users more likely to trust outputs under a fabricated persona and reducing transparency about who or what is responding.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users to install persistent LaunchAgent/systemd auto-start entries that will run a local proxy continuously in the background, but it does not clearly warn that this changes system/session startup behavior. Persistence is security-relevant because users may not realize the process survives reboots/login sessions, increasing the chance of unnoticed long-running network exposure or later misuse if the script is replaced.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The examples tell users to place ANTHROPIC_API_KEY directly into LaunchAgent/systemd environment configuration without discussing credential exposure. Secrets stored in service definitions can be readable to local users, exposed via backups/config sync, or left behind after uninstall, creating avoidable credential leakage risk.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The HEARTBEAT.md guidance causes repeated execution of the proxy health-check script in the background, but the documentation does not clearly explain the frequency or persistence implications. Repeated unattended execution can mask failures, consume resources, and keep a network-facing proxy active longer than users expect.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The proxy writes `body.system` content to `.ccproxy-system-context.md` on disk without disclosure, consent, lifecycle controls, or access restrictions. System content may contain sensitive instructions, memory, secrets, or proprietary data from upstream requests, creating unintended local persistence and exposure to other local users, processes, backups, or later reuse.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code forwards request prompts and history to the external `acpx`/Claude CLI backend, which may transmit data beyond the local process boundary under the user's subscription, but the proxy provides no user-facing notice, consent, or policy guardrails. Because this skill is explicitly designed to route OpenClaw traffic through a third-party model service, sensitive user content can be sent off-box unexpectedly.

Ssd 1

Medium

• Confidence: 93% confidence
• Finding: Framing operator-defined identity as "not roleplay" is an attempt to override the model's normal self-identification and safety behavior. This is more serious than simple branding because it encourages deceptive representation and can undermine safeguards that rely on truthful disclosure about the system in use.

Ssd 1

High

• Confidence: 98% confidence
• Finding: The documentation explicitly says the system prompt is written and passed as operator context to "avoid prompt injection rejection," which is a direct description of bypassing a model safety/control mechanism. In this skill's context, that means full upstream system prompts and conversation context are being repackaged to defeat rejection logic, increasing the likelihood of policy circumvention, unsafe instruction execution, and leakage of sensitive control text to an external provider.

Session Persistence

Medium

• Category: Rogue Agent

Content

Replace `[YOUR_AGENT_NAME]` with your agent's name (e.g., "Ozwald", "Dexter", "Atlas").

**b) Create a `CLAUDE.md` in your workspace** with your agent's full identity, style, and context. Claude Code reads this file automatically on every session. Copy the relevant parts from your `SOUL.md` / `IDENTITY.md`.

> **Why both?** `settings.json` is the minimum instruction Claude Code always respects. `CLAUDE.md` provides richer context (relationships, style, domain knowledge) that the agent reads when it needs it.

• Confidence: 84% confidence
• Finding: The skill instructs users to persist full identity, style, relationships, and domain context in a workspace `CLAUDE.md` that is read automatically every session. Persistent session state and identity files increase the blast radius of prompt injection, stale instruction contamination, and accidental disclosure of internal persona or operator context across future requests.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/ccproxy-ensure.js:42

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/claude-cli-proxy.js:34