Security audit

Claude Code Control

Security checks for vulnerabilities and agentic risk

Overview

This is a real Claude Code automation skill, but it can approve trust prompts, capture and save sensitive screen/session data, and has command-injection risks that need review before use.

Install only if you are comfortable granting Accessibility-driven control of Terminal and screen capture on macOS. Use it only on trusted project folders, avoid the trust-approval helpers unless you personally verify the prompt and path, and treat saved recordings and screenshots as sensitive files. The package should be fixed to avoid shell/AppleScript interpolation before use with untrusted paths, task text, or screenshot locations.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (7)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:179
Finding: Project Path Injection Enables Arbitrary Command Execution During Launch
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index.js:117
Finding: Command Text Injection Through Clipboard and Generated AppleScript
Content: View full analysis
50) { // Use clipboard for long text execSync(`echo ${JSON.stringify(text)} | pbcopy`, { timeout: 5000 }); runAppleScriptMulti([ 'tell application "System Events"', ' keystroke "v" using command down', 'end tell', ]); } else { // Direct keystroke for short text runAppleScriptMulti([ 'tell application "System Events"', ` keystroke "${text.replace(/"/g, '\\"')}"`, 'end tell', ]); } } ``` ### Technical Analysis For text longer than 50 characters, `JSON.stringify()` produces a double-quoted JavaScript string representation that is inserted into a shell command. Double quotes do not suppress shell command substitution, so constructs such as `$(command)` or backticks can be evaluated by the shell before `pbcopy` receives the content. For shorter text, only double quotes are escaped before the value is inserted into generated AppleScript. Backslashes, control characters, and line breaks are not handled with an AppleScript-safe encoding mechanism and may change the generated script. `typeText()` is exported publicly and is also reached by `send()`, so attacker-controlled task descriptions can reach these sinks. ### Attack Path 1. An attacker controls text passed to `typeText()` or the `command` argument passed to `send()`. 2. For a long payload, the attacker embeds shell command substitution in text exceeding 50 characters. 3. The value is included in `echo ${JSON.stringify(text)} | pbcopy`. 4. The shell evaluates the substitution before writing the remaining text to the clipboard. 5. The injected command executes as ...[truncated 489 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index.js:88
Finding: Caller-Controlled Screenshot Path Is Interpolated Into Shell Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index-old.js:137
Finding: Legacy Exported API Executes Caller-Supplied Commands Directly in a Shell
Content: View full analysis
${command}`); try { // Execute command directly in the session's working directory // This bypasses Claude Code's interactive layer const result = execSync(`cd "${session.path}" && ${command}`, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, // 10MB buffer timeout: timeoutSeconds * 1000, stdio: ['pipe', 'pipe', 'pipe'], }); ``` ### Technical Analysis The exported `send()` function appends the caller-controlled `command` directly to a shell command. There is no command allowlist, argument separation, escaping, or sandboxing. The implementation explicitly bypasses Claude Code's interactive layer and therefore bypasses any confirmations or policy enforcement that layer may provide. Although this is a legacy file rather than the package's declared main entry point, it is distributed in the project and can be imported directly. ### Attack Path 1. An application imports `index-old.js`. 2. An attacker controls or influences the `command` supplied to `send()`. 3. The command is concatenated after `cd "${session.path}" &&`. 4. `execSync()` invokes the shell and interprets all supplied operators and substitutions. 5. The attacker's command executes directly on the host. ### Impact Assessment This provides intentional, unrestricted command execution under the invoking user's account. The c ...[truncated 208 chars]
Remediation: View remediation

other

Warning

Location: index.js:88
Finding: Failed Window Detection Silently Captures the Entire Screen
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: index.js:313
Finding: Folder Trust Security Prompt Can Be Approved Programmatically Without State Verification
Content: View full analysis
setTimeout(resolve, 200)); pressEnter(); await new Promise(resolve => setTimeout(resolve, 2000)); console.log(`[CC-${sessionId}] ✅ Security prompt approved`); } ``` ### Technical Analysis The function sends a generic `1` followed by Enter after focusing Terminal. It does not inspect the screen, bind input to the Terminal window created for the specified session, or verify that the expected Claude Code trust prompt is currently displayed. Legacy implementations strengthen the concern by approving during launch automatically: `index-old.js:120-128`, `index-shell.js:75-89`, and `index-v2.js:54-65`. Trust prompts exist to require an informed decision before tooling operates in an untrusted repository. Automating approval without verifying context removes that protection. Because all sessions share front-window automation rather than a session-specific window handle, the keystrokes may also affect an unrelated Terminal prompt. ### Attack Path 1. An attacker persuades an application or agent to launch Claude Code in an untrusted project. 2. The caller invokes `approveSecurity()`, or a legacy implementation approves automatically. 3. The code focuses the front Terminal window but does not verify its identity or displayed content. 4. It sends `1` and Enter. 5. The untrusted project is marked trusted, or the keystrokes confi ...[truncated 557 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: index.js:38
Finding: Predictable Non-Exclusive AppleScript Temporary Files Permit Local Race Attacks
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Rogue AgentSelf-Modification, Session Persistence

Findings (36)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README advertises automatic handling of security prompts, including trust-folder and login-related flows, without warning that the tool may approve prompts on the user's behalf. This can weaken an important consent boundary and cause users or higher-level agents to grant trust or proceed through sensitive prompts without adequate review.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented approveSecurity() function explicitly presses '1' + Enter to approve a trust prompt, which normalizes bypassing manual review of a security decision. In a tool designed to drive another coding agent through a visible terminal, this increases the risk of blindly trusting an unintended project or state, potentially enabling dangerous downstream actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatically approving a security/trust prompt bypasses a deliberate user checkpoint intended to prevent operation in untrusted contexts. In an agent skill that may be pointed at arbitrary repositories, this increases the chance of executing or enabling unsafe actions in malicious workspaces without user awareness.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The send() API advertises interaction with a Claude Code session, but actually executes the provided string as a shell command via execSync in the project directory. This creates arbitrary command execution with the caller's privileges and defeats any safety expectations, policy mediation, or auditability implied by routing through Claude Code.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code accepts an arbitrary command string and executes it through the shell with no validation, allowlist, or confirmation. Because this is packaged as an agent skill, upstream callers may assume it is a safe abstraction, but it effectively exposes raw shell execution in the workspace and enables destructive commands, data exfiltration, or persistence.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code detects Claude Code's security/trust prompt and automatically answers 'Yes, I trust this folder' without user confirmation. This defeats a built-in trust boundary designed to prevent operating in potentially unsafe directories, increasing the chance that malicious repository contents or prompts are treated as trusted.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The implementation auto-approves a security/trust prompt without any explicit warning or approval flow. This suppresses an intentional security checkpoint and can cause the agent to operate with elevated trust in unreviewed project content, which is especially risky in a code-execution/control skill.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · index-v2.js (reported line 58)May include surrounding context.
js
console.log(`[CC-${sessionId}] [STDERR] ${chunk}`); }); // Wait for Claude Code to start and show prompt await new Promise((resolve) => { setTimeout(() => { // Send security approval (option 1)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code automatically sends approval input to the interactive Claude Code process ('1\n' and confirmation) without any user validation or policy check. This bypasses an interactive security gate by design, allowing downstream actions to proceed under permissions the user never explicitly granted, which is especially dangerous because this skill is meant to control another agent process programmatically.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Each command sent is logged along with timing and a screenshot taken after execution, creating a detailed history of user-provided input and visible output. In a terminal-control skill, this can retain secrets, tokens, file contents, prompts, and other sensitive material, turning routine interaction into a data-collection channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code programmatically approves a security trust prompt by sending '1' and Enter without any confirmation from the user. This bypasses an intentional safety gate designed to ensure the user explicitly authorizes project access, making accidental or unauthorized trust escalation much easier.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The recording structure persists session logs containing commands and screenshot paths, and the surrounding workflow captures screenshots throughout the session. In this context, that creates a durable trail of potentially sensitive natural-language inputs, operational details, and references to captured screen data, increasing the likelihood of credential, secret, or proprietary information leakage.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The lockfile pins a transitive dependency on form-data 4.0.5, which is flagged with a HIGH-severity advisory for CRLF injection in multipart field names. If this package is used to construct multipart requests from attacker-controlled input, an attacker may inject additional headers or corrupt request structure, potentially enabling request smuggling-like behavior or unintended parameter/header manipulation against downstream services.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · tasks/route-task.js (reported line 20)May include surrounding context.
js
eenshot, recordingPath, duration_ms } * * CLI: * node tasks/route-task.js --project /path/to/project --task "description" [--wait 120] [--approve] */ const path = require('path'); const fs = require('fs'); const cc = require('../index'); /** * Route a task to Claude Code in a managed session. * * @param {string} projectPath - Absolute path to the project directory * @param {string} taskDescription - Task to send to Claude Code * @param {object} opts * @param {number} [opts.waitSeconds=120] - Seconds to wait after sending task * @param {boolean} [opts.approve=false] - Approve security prompt before task * @param {string} [opts.sessionDir=null] - Directory for session recordings * @returns {Promise<{ sessionId, screenshot, recordingPath, duration_ms }>} */ async function routeTask(projectPath, taskDescription, opts = {}) { const startTime = Date.now(); const waitSeconds = opts.waitSeconds ?? 120; const shouldApprove = opts.approve ?? false; const sessionDi

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README promotes screenshot capture and session recording of a live terminal without warning that terminals commonly display secrets, credentials, proprietary code, and command history. In an agent-skill context, this omission can lead users to enable logging by default and unintentionally persist or expose sensitive on-screen data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The saveSession() documentation states that full session logs, including commands and screenshots, are written to disk but does not warn that this creates durable records of potentially sensitive terminal activity. Persisted artifacts can later be accessed, shared, backed up, or exfiltrated, increasing exposure beyond the live session itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly advertises recording full terminal sessions and saving timestamped logs/JSON, but it does not warn that terminal content may include sensitive source code, prompts, secrets, tokens, file paths, or authentication material. In a tool that programmatically drives Claude Code and captures screenshots, this omission increases the risk of accidental sensitive-data collection and retention by users who may not realize the privacy implications.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The launch flow automatically answers the trust prompt by writing '1' and confirming, which silently escalates trust for the folder without informed user consent. In a security-sensitive tool, auto-trusting a workspace can disable an important safeguard against running in untrusted or attacker-controlled directories.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 87% confidence
Finding: The autonomous decision to approve the trust prompt is itself security-relevant because it removes human review from a trust boundary decision. In this skill context, that behavior is more dangerous because the tool is designed to operate on project directories and could be directed at untrusted repositories.
Content: Scanner excerpt · index-old.js (reported line 121)May include surrounding context.
js
session.stderr += data.toString(); }); // Auto-approve security check await new Promise((resolve) => setTimeout(resolve, 500)); // Send "Yes, I trust this folder" (option 1)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The header comment says this is a 'Proper PTY-based interactive control' implementation, and line L028 repeats that claim. However, the process is created via child_process.spawn with stdio set to ['pipe','pipe','pipe'] at L030-L034, which is standard piped I/O rather than an actual pseudo-terminal. This is an active contradiction between the documentation and the implementation, not merely an omitted detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The session recorder stores full stdout/stderr and commands for the entire interactive session, which may include secrets, credentials, proprietary code, or sensitive prompts. In an agent-control skill, this is more dangerous because the tool centralizes all interaction data and makes later disclosure or misuse easier.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Full session recording of commands and model output creates a durable store of potentially sensitive user inputs, generated content, tokens, and repository data. In this skill context, the danger is amplified because the component is specifically designed to automate and observe an interactive coding agent session end-to-end.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 98% confidence
Finding: The autonomous decision here is to approve a security-sensitive trust prompt on the user's behalf. Automating that choice removes a deliberate human checkpoint and can expose the environment to unsafe repository instructions or content that would otherwise remain untrusted.
Content: Scanner excerpt · index-shell.js (reported line 89)May include surrounding context.
js
session.outputBuffer.includes('Trust')) { clearInterval(checkReady); // Auto-approve: send "1" for "Yes, I trust this folder" console.log(`[CC-${sessionId}] ✅ Security prompt detected, auto-approving...`); session.proc.stdin.write('1\n');

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: Session persistence is not inherently malicious, but saving complete interaction history introduces confidentiality risk because transcripts may contain secrets or sensitive operational details. In a shell/control skill, persisted sessions are especially sensitive due to the breadth of captured commands and outputs.
Content: Scanner excerpt · index-shell.js (reported line 237)May include surrounding context.
js
} /** * Save session to file */ async function saveSession(sessionId, filepath) { const session = sessions.get(sessionId);

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code writes the full session recording to an arbitrary file path without any warning that terminal history may contain sensitive material. Persisting transcripts to disk increases the exposure window and can leak secrets through backups, shared filesystems, or later unintended access.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index-old.js:90

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index-shell.js:30

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index-v2.js:29

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:27

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: manual-tests.js:68

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test.js:17