Security audit

Ccsinfo

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its setup guidance can expose private Claude Code session history over a network without enough safety controls.

Install only if you trust the ccsinfo server and understand that it can expose Claude Code conversations, prompts, tool outputs, project paths, and possibly secrets. Prefer running the server on 127.0.0.1, using an SSH tunnel or VPN for remote access, pinning the CLI/server version, and avoiding plaintext LAN exposure unless protected by strong network controls and authentication.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/install.sh:11
Finding: Unpinned Third-Party Package Installation Executes Mutable Upstream Code
Content: View full analysis
Remediation: View remediation
' ``` 2. For Git-based installation, pin an immutable reviewed commit: ```bash uv tool install 'git+https://github.com/myk-org/ccsinfo.git@' ``` 3. Use one consistent, documented source for both client and server installation. 4. Remove automatic `--upgrade` behavior from routine Skill installation. 5. Generate and retain a lock file or equivalent record for transitive dependencies. 6. Verify downloaded artifacts using trusted hashes or package signatures where supported. 7. Perform dependency review and vulnerability scanning before updating the pinned version. 8. Run installation with an unprivileged account and avoid invoking it through `sudo`. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:20
Finding: Sensitive Claude Code Session Service Is Documented for Plaintext Network-Wide Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to expose and query Claude Code session data from a remote server, including binding the server to 0.0.0.0 and connecting over plain HTTP to a private IP, but it provides no warning about sensitive data exposure, authentication, encryption, or network trust boundaries. Because session data, prompts, tool calls, and task history can contain secrets or proprietary information, users may deploy this in an insecure way and unknowingly transmit or expose sensitive data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs users to run ccsinfo serve --host 0.0.0.0 --port 9999, which exposes Claude Code session data over the network, but it does not provide a prominent warning about the sensitivity of that data or the risks of LAN exposure. Claude Code session history can include prompts, tool outputs, file paths, secrets, and other sensitive operational data, so omission of a clear security warning increases the chance that users will unintentionally expose private information to other hosts on the network.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document states that commands automatically use $CCSINFO_SERVER_URL, meaning operators may connect to a configured remote server and retrieve or disclose data without explicit acknowledgment in each command example. Because this skill is specifically designed to query remote session data, failing to warn about the remote target and data sensitivity makes accidental transmission or access more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The reference explicitly documents commands for viewing session messages, tool calls, and prompt history, which are likely to contain sensitive user conversations, system prompts, secrets, or operational metadata. In a skill whose purpose is remote inspection of Claude Code session data, omitting any warning about sensitivity or access restrictions increases the chance of accidental overexposure or misuse by operators.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.