Claude Code Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:27 PM UTC
• Version: 1.2.0

Overview

This is a real Claude Code automation skill, but it can approve trust prompts, capture and save sensitive screen/session data, and has command-injection risks that need review before use.

Install only if you are comfortable granting Accessibility-driven control of Terminal and screen capture on macOS. Use it only on trusted project folders, avoid the trust-approval helpers unless you personally verify the prompt and path, and treat saved recordings and screenshots as sensitive files. The package should be fixed to avoid shell/AppleScript interpolation before use with untrusted paths, task text, or screenshot locations.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:179
• Finding: Project Path Injection Enables Arbitrary Command Execution During Launch<![CDATA[ ## Vulnerability Details **File Location**: `index.js:179-194` **Vulnerability Type**: Shell and AppleScript injection **Risk Level**: High ### Vulnerable Code ```javascript async function launch(projectPath, options = {}) { const sessionId = ++sessionCounter; const normalizedPath = path.resolve(projectPath); if (!fs.existsSync(normalizedPath)) { throw new Error(`Project path does not exist: ${normalizedPath}`); } console.log(`[CC-${sessionId}] 🚀 Opening Terminal.app with Claude Code at ${normalizedPath}`); // Open a new Terminal.app window and run claude code runAppleScriptMulti([ 'tell application "Terminal"', ' activate', ` do script "cd '${normalizedPath}' && claude code"`, 'end tell', ]); ``` ### Technical Analysis The resolved project path is inserted directly into both an AppleScript string literal and a shell command executed by Terminal.app. `path.resolve()` normalizes a path but does not make it safe for either AppleScript or shell interpolation. The only validation confirms that the path exists. A directory name containing a single quote can terminate the shell-quoted path, while double quotes, backslashes, or line breaks can alter the generated AppleScript. Because Terminal executes the generated `do script` command, a crafted existing path can introduce additional shell commands. The operation runs under the current user's account and benefits from the Accessibility permissions required by the package. ### Attack Path 1. An attacker influences the `projectPath` supplied to `launch()`. 2. The attacker creates or identifies an existing directory whose name contains shell or AppleScript metacharacters. 3. `path.resolve()` preserves the dangerous characters. 4. The path is interpolated into `do script "cd '${normalizedPath}' && claude code"`. 5. Terminal.app interprets the injected shell syntax. 6. Arbitrary local commands execute with the invoking user's privileges. ### Impact Assessment S ...[truncated 363 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not construct AppleScript source or shell commands by interpolating the project path. - Pass the path to AppleScript through `osascript` arguments and access it through `on run argv`. - Inside AppleScript, use a safely quoted shell argument rather than concatenating untrusted text. - Prefer launching a fixed executable with `spawn()` or `execFile()` and an explicit `cwd`. - Verify that the resolved target is a directory and, where feasible, restrict it to approved workspace roots. - Add regression tests covering quotes, backslashes, line breaks, command substitutions, and Unicode characters in directory names. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:117
• Finding: Command Text Injection Through Clipboard and Generated AppleScript<![CDATA[ ## Vulnerability Details **File Location**: `index.js:117-136` **Vulnerability Type**: Shell and AppleScript injection **Risk Level**: High ### Vulnerable Code ```javascript /** * Type text into the frontmost application via System Events */ function typeText(text) { // Use keystroke for short text, or write to clipboard and paste for long text if (text.length > 50) { // Use clipboard for long text execSync(`echo ${JSON.stringify(text)} | pbcopy`, { timeout: 5000 }); runAppleScriptMulti([ 'tell application "System Events"', ' keystroke "v" using command down', 'end tell', ]); } else { // Direct keystroke for short text runAppleScriptMulti([ 'tell application "System Events"', ` keystroke "${text.replace(/"/g, '\\"')}"`, 'end tell', ]); } } ``` ### Technical Analysis For text longer than 50 characters, `JSON.stringify()` produces a double-quoted JavaScript string representation that is inserted into a shell command. Double quotes do not suppress shell command substitution, so constructs such as `$(command)` or backticks can be evaluated by the shell before `pbcopy` receives the content. For shorter text, only double quotes are escaped before the value is inserted into generated AppleScript. Backslashes, control characters, and line breaks are not handled with an AppleScript-safe encoding mechanism and may change the generated script. `typeText()` is exported publicly and is also reached by `send()`, so attacker-controlled task descriptions can reach these sinks. ### Attack Path 1. An attacker controls text passed to `typeText()` or the `command` argument passed to `send()`. 2. For a long payload, the attacker embeds shell command substitution in text exceeding 50 characters. 3. The value is included in `echo ${JSON.stringify(text)} | pbcopy`. 4. The shell evaluates the substitution before writing the remaining text to the clipboard. 5. The injected command executes as ...[truncated 489 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the shell pipeline with a non-shell invocation: ```javascript spawnSync('pbcopy', [], { input: String(text), encoding: 'utf8', shell: false, }); ``` - Do not embed text directly into AppleScript source. Pass it through `osascript` positional arguments or place it on the clipboard using a non-shell process. - Validate that `text` is a string and impose reasonable size limits. - Avoid relying on ad hoc quote replacement for shell, AppleScript, JSON, or terminal contexts. - Add tests using `$()`, backticks, quotes, backslashes, newlines, and AppleScript delimiters. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:88
• Finding: Caller-Controlled Screenshot Path Is Interpolated Into Shell Commands<![CDATA[ ## Vulnerability Details **File Location**: `index.js:88-105` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```javascript function takeScreenshot(outputPath) { const filePath = outputPath || `/tmp/cc-screenshot-${Date.now()}.png`; try { // First, focus Terminal so it's on top focusTerminal(); // Try to get window bounds for a targeted capture const bounds = getTerminalWindowBounds(); if (bounds) { // screencapture -R x,y,w,h captures a specific region execSync(`screencapture -x -R "${bounds.x},${bounds.y},${bounds.w},${bounds.h}" "${filePath}"`, { timeout: 5000 }); } else { // Fallback: capture the whole screen execSync(`screencapture -x "${filePath}"`, { timeout: 5000 }); } ``` ### Technical Analysis The public `takeScreenshot(outputPath)` function inserts `outputPath` into a command interpreted by a shell. Surrounding the value with double quotes is insufficient because an embedded double quote can terminate the argument and introduce shell syntax. Command substitutions may also be evaluated inside double quotes. No path validation, extension restriction, output-directory restriction, or shell-safe argument handling is applied. ### Attack Path 1. An attacker influences `outputPath` passed to `takeScreenshot()`. 2. The supplied value contains shell metacharacters or command substitution. 3. The value is interpolated into an `execSync()` command string. 4. The shell parses the attacker-controlled syntax. 5. Arbitrary commands execute with the current user's privileges. ### Impact Assessment An attacker can execute local commands, overwrite user-accessible files, or redirect screenshot output to unintended locations. The command runs with the same access as the Node.js process and is not restricted to the project directory or `/tmp`. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Invoke `screencapture` with `execFileSync()` or `spawnSync()` and an argument array rather than a shell command string. - Resolve the output path and restrict it to an approved recording directory. - Reject paths containing null bytes and verify that the parent directory is expected and privately writable. - Create output files with restrictive permissions and prevent unintended overwrites where appropriate. - Treat window bounds as validated integers before converting them into command arguments. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index-old.js:137
• Finding: Legacy Exported API Executes Caller-Supplied Commands Directly in a Shell<![CDATA[ ## Vulnerability Details **File Location**: `index-old.js:137-160` **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```javascript /** * Send a command to Claude Code via subprocess execution * (Since Claude Code interactive session output is hard to capture, * we execute commands directly in the workspace) */ async function send(sessionId, command, timeoutSeconds = 300) { const session = sessions.get(sessionId); if (!session) { throw new Error(`Invalid session: ${sessionId}`); } const startTime = Date.now(); session.commandCount++; console.log(`[CC-${sessionId}] > ${command}`); try { // Execute command directly in the session's working directory // This bypasses Claude Code's interactive layer const result = execSync(`cd "${session.path}" && ${command}`, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, // 10MB buffer timeout: timeoutSeconds * 1000, stdio: ['pipe', 'pipe', 'pipe'], }); ``` ### Technical Analysis The exported `send()` function appends the caller-controlled `command` directly to a shell command. There is no command allowlist, argument separation, escaping, or sandboxing. The implementation explicitly bypasses Claude Code's interactive layer and therefore bypasses any confirmations or policy enforcement that layer may provide. Although this is a legacy file rather than the package's declared main entry point, it is distributed in the project and can be imported directly. ### Attack Path 1. An application imports `index-old.js`. 2. An attacker controls or influences the `command` supplied to `send()`. 3. The command is concatenated after `cd "${session.path}" &&`. 4. `execSync()` invokes the shell and interprets all supplied operators and substitutions. 5. The attacker's command executes directly on the host. ### Impact Assessment This provides intentional, unrestricted command execution under the invoking user's account. The c ...[truncated 208 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `index-old.js` from the distributed package if it is obsolete. - Do not expose raw shell command execution as a Claude Code interaction API. - If process execution is required, use a fixed executable and an explicit argument array with `spawn()` or `execFile()`. - Apply an allowlist of permitted operations and reject shell operators. - Run unavoidable development commands inside a dedicated sandbox, container, or restricted user account. - Document the trust boundary and require explicit authorization before executing any host command. ]]>

other

Warning

• Location: index.js:88
• Finding: Failed Window Detection Silently Captures the Entire Screen<![CDATA[ ## Vulnerability Details **File Location**: `index.js:88-105` **Vulnerability Type**: Excessive screen capture and privacy boundary failure **Risk Level**: Medium ### Vulnerable Code ```javascript /** * Take a screenshot of the Terminal.app window only. * Falls back to full screen if window bounds can't be detected. */ function takeScreenshot(outputPath) { const filePath = outputPath || `/tmp/cc-screenshot-${Date.now()}.png`; try { // First, focus Terminal so it's on top focusTerminal(); // Try to get window bounds for a targeted capture const bounds = getTerminalWindowBounds(); if (bounds) { // screencapture -R x,y,w,h captures a specific region execSync(`screencapture -x -R "${bounds.x},${bounds.y},${bounds.w},${bounds.h}" "${filePath}"`, { timeout: 5000 }); } else { // Fallback: capture the whole screen execSync(`screencapture -x "${filePath}"`, { timeout: 5000 }); } ``` ### Technical Analysis The documented feature is targeted Terminal-window capture. However, when Terminal bounds cannot be obtained, the implementation silently invokes `screencapture` without a region and records the entire display. Window-bound detection can fail because Terminal is unavailable, AppleScript returns no output, permissions are missing, or the front window cannot be queried. The resulting screenshot may contain unrelated applications, notifications, authentication prompts, private communications, or credentials. Screenshot paths are subsequently included in session logs, extending the lifetime and discoverability of the captured data. ### Attack Path 1. Terminal window-bound detection fails or is deliberately disrupted. 2. `getTerminalWindowBounds()` returns `null`. 3. `takeScreenshot()` uses the unrestricted full-screen fallback. 4. Sensitive content from other visible applications is written to a screenshot file. 5. The path is returned to the caller or retained in a session recording. 6. Any pro ...[truncated 408 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Fail closed when Terminal bounds cannot be determined. - Require explicit, separately documented user consent before any full-screen capture. - Return an error rather than silently broadening the capture scope. - Use a window-specific capture mechanism where available instead of coordinate-based display capture. - Store screenshots in a private directory with mode `0700` and files with mode `0600`. - Implement retention controls and remove temporary screenshots when the session ends unless the user explicitly saves them. - Clearly disclose screenshot scope and retention behavior. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: index.js:313
• Finding: Folder Trust Security Prompt Can Be Approved Programmatically Without State Verification<![CDATA[ ## Vulnerability Details **File Location**: `index.js:313-334` **Vulnerability Type**: Security-boundary bypass through automated UI input **Risk Level**: Medium ### Vulnerable Code ```javascript /** * Handle Claude Code security prompt (approve project access) */ async function approveSecurity(sessionId) { const session = sessions.get(sessionId); if (!session) throw new Error(`Invalid session: ${sessionId}`); console.log(`[CC-${sessionId}] 🔓 Approving security prompt...`); // Bring Terminal to front focusTerminal(); // Press 1 for "Yes, I trust this folder" typeText('1'); await new Promise(resolve => setTimeout(resolve, 200)); pressEnter(); await new Promise(resolve => setTimeout(resolve, 2000)); console.log(`[CC-${sessionId}] ✅ Security prompt approved`); } ``` ### Technical Analysis The function sends a generic `1` followed by Enter after focusing Terminal. It does not inspect the screen, bind input to the Terminal window created for the specified session, or verify that the expected Claude Code trust prompt is currently displayed. Legacy implementations strengthen the concern by approving during launch automatically: `index-old.js:120-128`, `index-shell.js:75-89`, and `index-v2.js:54-65`. Trust prompts exist to require an informed decision before tooling operates in an untrusted repository. Automating approval without verifying context removes that protection. Because all sessions share front-window automation rather than a session-specific window handle, the keystrokes may also affect an unrelated Terminal prompt. ### Attack Path 1. An attacker persuades an application or agent to launch Claude Code in an untrusted project. 2. The caller invokes `approveSecurity()`, or a legacy implementation approves automatically. 3. The code focuses the front Terminal window but does not verify its identity or displayed content. 4. It sends `1` and Enter. 5. The untrusted project is marked trusted, or the keystrokes confi ...[truncated 557 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove automatic trust approval from all current and legacy implementations. - Require a direct, informed user confirmation for each previously untrusted project. - Display the canonical resolved project path before requesting approval. - Bind each session to a specific Terminal window or tab and verify that window before injecting input. - Verify the exact expected prompt state before any automated keypress. - Default to refusal when prompt detection is ambiguous or unavailable. - Restrict launchable projects to configured workspace roots where practical. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: index.js:38
• Finding: Predictable Non-Exclusive AppleScript Temporary Files Permit Local Race Attacks<![CDATA[ ## Vulnerability Details **File Location**: `index.js:38-54` **Vulnerability Type**: Insecure temporary-file creation **Risk Level**: Low ### Vulnerable Code ```javascript /** * Run multi-line AppleScript */ function runAppleScriptMulti(lines) { const script = lines.join('\n'); const tmpFile = `/tmp/cc-applescript-${Date.now()}.scpt`; fs.writeFileSync(tmpFile, script); try { return execSync(`osascript ${tmpFile}`, { encoding: 'utf-8', timeout: 15000, }).trim(); } catch (err) { console.error(`[AppleScript Error] ${err.message}`); return ''; } finally { try { fs.unlinkSync(tmpFile); } catch {} } } ``` ### Technical Analysis Temporary files are named using only the current timestamp and are written to the shared `/tmp` directory. The file is not created with exclusive semantics, and no private temporary directory or explicit restrictive mode is used. A local attacker capable of predicting or racing the timestamp may pre-create the path, use a symbolic link where filesystem permissions permit it, or modify an attacker-owned raced file between the write and `osascript` execution. The temporary path is also passed through a shell command instead of as a process argument. ### Attack Path 1. A local attacker monitors or predicts calls to `runAppleScriptMulti()`. 2. The attacker guesses the millisecond-based filename in `/tmp`. 3. The attacker pre-creates or races the expected file path. 4. The victim process writes the generated script or subsequently executes the raced path. 5. The attacker attempts to redirect the write or replace the script before `osascript` reads it. 6. Attacker-controlled AppleScript may execute with the victim process's permissions. ### Impact Assessment Exploitation requires local access and successful timing, which lowers practical severity. If successful, it may allow execution of attacker-controlled AppleScript as the invoking user or corruption of files writable by that use ...[truncated 92 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create a private temporary directory using `fs.mkdtempSync(path.join(os.tmpdir(), 'cc-applescript-'))`. - Create the script with exclusive semantics and mode `0600`. - Invoke `osascript` using `execFileSync('osascript', [tmpFile], ...)` rather than a shell command. - Remove the complete private temporary directory in a `finally` block. - Prefer passing the script through standard input or `osascript` arguments where feasible, eliminating the temporary file. - Do not use timestamps alone as security-sensitive temporary names. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (36)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The README advertises automatic handling of security prompts, including trust-folder and login-related flows, without warning that the tool may approve prompts on the user's behalf. This can weaken an important consent boundary and cause users or higher-level agents to grant trust or proceed through sensitive prompts without adequate review.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documented approveSecurity() function explicitly presses '1' + Enter to approve a trust prompt, which normalizes bypassing manual review of a security decision. In a tool designed to drive another coding agent through a visible terminal, this increases the risk of blindly trusting an unintended project or state, potentially enabling dangerous downstream actions.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Automatically approving a security/trust prompt bypasses a deliberate user checkpoint intended to prevent operation in untrusted contexts. In an agent skill that may be pointed at arbitrary repositories, this increases the chance of executing or enabling unsafe actions in malicious workspaces without user awareness.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The send() API advertises interaction with a Claude Code session, but actually executes the provided string as a shell command via execSync in the project directory. This creates arbitrary command execution with the caller's privileges and defeats any safety expectations, policy mediation, or auditability implied by routing through Claude Code.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code accepts an arbitrary command string and executes it through the shell with no validation, allowlist, or confirmation. Because this is packaged as an agent skill, upstream callers may assume it is a safe abstraction, but it effectively exposes raw shell execution in the workspace and enables destructive commands, data exfiltration, or persistence.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The code detects Claude Code's security/trust prompt and automatically answers 'Yes, I trust this folder' without user confirmation. This defeats a built-in trust boundary designed to prevent operating in potentially unsafe directories, increasing the chance that malicious repository contents or prompts are treated as trusted.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The implementation auto-approves a security/trust prompt without any explicit warning or approval flow. This suppresses an intentional security checkpoint and can cause the agent to operate with elevated trust in unreviewed project content, which is especially risky in a code-execution/control skill.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

console.log(`[CC-${sessionId}] [STDERR] ${chunk}`);
  });

  // Wait for Claude Code to start and show prompt
  await new Promise((resolve) => {
    setTimeout(() => {
      // Send security approval (option 1)

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code automatically sends approval input to the interactive Claude Code process (`'1\n'` and confirmation) without any user validation or policy check. This bypasses an interactive security gate by design, allowing downstream actions to proceed under permissions the user never explicitly granted, which is especially dangerous because this skill is meant to control another agent process programmatically.

Ssd 3

High

• Confidence: 97% confidence
• Finding: Each command sent is logged along with timing and a screenshot taken after execution, creating a detailed history of user-provided input and visible output. In a terminal-control skill, this can retain secrets, tokens, file contents, prompts, and other sensitive material, turning routine interaction into a data-collection channel.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code programmatically approves a security trust prompt by sending '1' and Enter without any confirmation from the user. This bypasses an intentional safety gate designed to ensure the user explicitly authorizes project access, making accidental or unauthorized trust escalation much easier.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The recording structure persists session logs containing commands and screenshot paths, and the surrounding workflow captures screenshots throughout the session. In this context, that creates a durable trail of potentially sensitive natural-language inputs, operational details, and references to captured screen data, increasing the likelihood of credential, secret, or proprietary information leakage.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The lockfile pins a transitive dependency on form-data 4.0.5, which is flagged with a HIGH-severity advisory for CRLF injection in multipart field names. If this package is used to construct multipart requests from attacker-controlled input, an attacker may inject additional headers or corrupt request structure, potentially enabling request smuggling-like behavior or unintended parameter/header manipulation against downstream services.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

eenshot, recordingPath, duration_ms }
 *
 * CLI:
 *   node tasks/route-task.js --project /path/to/project --task "description" [--wait 120] [--approve]
 */
const path = require('path');
const fs = require('fs');
const cc = require('../index');

/**
 * Route a task to Claude Code in a managed session.
 *
 * @param {string} projectPath - Absolute path to the project directory
 * @param {string} taskDescription - Task to send to Claude Code
 * @param {object} opts
 * @param {number}  [opts.waitSeconds=120]  - Seconds to wait after sending task
 * @param {boolean} [opts.approve=false]    - Approve security prompt before task
 * @param {string}  [opts.sessionDir=null]  - Directory for session recordings
 * @returns {Promise<{ sessionId, screenshot, recordingPath, duration_ms }>}
 */
async function routeTask(projectPath, taskDescription, opts = {}) {
  const startTime = Date.now();
  const waitSeconds = opts.waitSeconds ?? 120;
  const shouldApprove = opts.approve ?? false;
  const sessionDi

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README promotes screenshot capture and session recording of a live terminal without warning that terminals commonly display secrets, credentials, proprietary code, and command history. In an agent-skill context, this omission can lead users to enable logging by default and unintentionally persist or expose sensitive on-screen data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The saveSession() documentation states that full session logs, including commands and screenshots, are written to disk but does not warn that this creates durable records of potentially sensitive terminal activity. Persisted artifacts can later be accessed, shared, backed up, or exfiltrated, increasing exposure beyond the live session itself.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly advertises recording full terminal sessions and saving timestamped logs/JSON, but it does not warn that terminal content may include sensitive source code, prompts, secrets, tokens, file paths, or authentication material. In a tool that programmatically drives Claude Code and captures screenshots, this omission increases the risk of accidental sensitive-data collection and retention by users who may not realize the privacy implications.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The launch flow automatically answers the trust prompt by writing '1' and confirming, which silently escalates trust for the folder without informed user consent. In a security-sensitive tool, auto-trusting a workspace can disable an important safeguard against running in untrusted or attacker-controlled directories.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

session.stderr += data.toString();
  });

  // Auto-approve security check
  await new Promise((resolve) => setTimeout(resolve, 500));
  
  // Send "Yes, I trust this folder" (option 1)

• Confidence: 87% confidence
• Finding: The autonomous decision to approve the trust prompt is itself security-relevant because it removes human review from a trust boundary decision. In this skill context, that behavior is more dangerous because the tool is designed to operate on project directories and could be directed at untrusted repositories.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The header comment says this is a 'Proper PTY-based interactive control' implementation, and line L028 repeats that claim. However, the process is created via child_process.spawn with stdio set to ['pipe','pipe','pipe'] at L030-L034, which is standard piped I/O rather than an actual pseudo-terminal. This is an active contradiction between the documentation and the implementation, not merely an omitted detail.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The session recorder stores full stdout/stderr and commands for the entire interactive session, which may include secrets, credentials, proprietary code, or sensitive prompts. In an agent-control skill, this is more dangerous because the tool centralizes all interaction data and makes later disclosure or misuse easier.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Full session recording of commands and model output creates a durable store of potentially sensitive user inputs, generated content, tokens, and repository data. In this skill context, the danger is amplified because the component is specifically designed to automate and observe an interactive coding agent session end-to-end.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

session.outputBuffer.includes('Trust')) {
        clearInterval(checkReady);
        
        // Auto-approve: send "1" for "Yes, I trust this folder"
        console.log(`[CC-${sessionId}] ✅ Security prompt detected, auto-approving...`);
        session.proc.stdin.write('1\n');

• Confidence: 98% confidence
• Finding: The autonomous decision here is to approve a security-sensitive trust prompt on the user's behalf. Automating that choice removes a deliberate human checkpoint and can expose the environment to unsafe repository instructions or content that would otherwise remain untrusted.

Session Persistence

Medium

• Category: Rogue Agent

Content

}

/**
 * Save session to file
 */
async function saveSession(sessionId, filepath) {
  const session = sessions.get(sessionId);

• Confidence: 88% confidence
• Finding: Session persistence is not inherently malicious, but saving complete interaction history introduces confidentiality risk because transcripts may contain secrets or sensitive operational details. In a shell/control skill, persisted sessions are especially sensitive due to the breadth of captured commands and outputs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code writes the full session recording to an arbitrary file path without any warning that terminal history may contain sensitive material. Persisting transcripts to disk increases the exposure window and can leak secrets through backups, shared filesystems, or later unintended access.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index-old.js:90

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index-shell.js:30

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index-v2.js:29

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:27

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: manual-tests.js:68

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test.js:17