ClawHub
Back to skill

Security audit

Sdd Dev Workflow

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real development automation workflow, but it grants agents broad authority to approve prompts, install software, and publish code with insufficient safeguards.

Install only if you are comfortable running it in a VM or container with test credentials. Review every shell installer, disable or avoid bypassPermissions, do not allow automatic apt/pip installs from error text, and require manual confirmation before Git push or PR creation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (7)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/installation.md:79
Finding

Unverified Remote Installation Scripts Are Executed Directly by a Shell

Content
View full analysis
/dev/null; then UV_VER=$(uv --version 2>&1) check_pass "UV is installed: $UV_VER" else check_fail "UV is not installed" "curl -LsSf https://astral.sh/uv/install.sh | sh" fi ``` ### Technical Analysis The installation instructions retrieve mutable content from external URLs and immediately pipe it into a shell. No version pinning, checksum validation, signature verification, or local inspection step occurs before execution. The NodeSource command is particularly dangerous because the remote response is executed through `sudo -E bash`, giving the downloaded payload root-level privileges while preserving portions of the caller's environment. The UV command executes with the invoking user's privileges and can modify user startup files, executable search paths, and files accessible to that account. Although the referenced domains appear related to the intended dependencies, HTTPS authenticates only the current endpoint connection. It does not make changing remote script content equivalent to a reviewed, immutable artifact. The environment-checking script does not execute the UV installer itself, but it presents the unsafe pipeline as the recommended re ...[truncated 1139 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
references/dependency-installation.md:219
Finding

Untrusted Error Text Can Trigger Automatic Installation of Attacker-Selected Packages

Content
View full analysis
/dev/null || \ apt-get install -y "$cmd" 2>/dev/null || \ echo "Unable to install $cmd automatically; human intervention required" fi done } # Usage example claude --permission-mode bypassPermissions 2>&1 | monitor_and_install ``` The governing policy also states that missing dependencies should be installed immediately without asking the user. ### Technical Analysis Package names are extracted from process output and supplied directly to package managers. Generated applications, tests, build scripts, or prompt-influenced agents can produce attacker-selected `ModuleNotFoundError` or `command not found` text. Quoting the shell variable prevents shell metacharacter injection, but it does not make the selected package trustworthy. The attacker can choose the semantic package name and cause retrieval from public registries. Python packages may execute code during build or installation, and installed packages execute arbitrary code when imported. No allowlist, lockfile, version constraint, hash verification, registry restriction, or user approval is applied. The fallback from `pip` to `apt-get` also crosses ...[truncated 1322 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/sdd-driver.sh:181
Finding

Generic Claude Code Permission Prompts Are Automatically Approved

Content
View full analysis
/dev/null 2>&1 stuck_counter=0 last_output="" sleep 2 continue fi ``` The launcher also confirms bypass and trust prompts: ```bash local permission_mode="${3:-acceptEdits}" tmux -S "$SOCKET" send-keys -t "$session_name" \ "claude --permission-mode $permission_mode" Enter sleep 3 if [ "$permission_mode" = "bypassPermissions" ]; then tmux -S "$SOCKET" send-keys -t "$session_name" "2" Enter sleep 3 fi # Confirm directory trust tmux -S "$SOCKET" send-keys -t "$session_name" Enter ``` Troubleshooting guidance additionally presents: ```bash claude --dangerously-skip-permissions ``` ### Technical Analysis The driver approves every captured prompt containing the generic phrase `Do you want to proceed?` without determining what operation is being authorized. This negates the documented distinction between `acceptEdits`, where shell commands should require confirmation, and unrestricted execution. The helper also accepts the bypass-mode warning and directory-trust prompt automatically. Directory trust is a security decision because project-controlled files may influence agent behavior. The Skill therefore delegates broad authority to generated or project-supplied instructions while presenting `acceptEdits` as the safer default. Prompt text is checked using a broad substring match over captured terminal output. It is not bound to an expected action, command, capability, or o ...[truncated 1042 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/claude-code-helper.sh:27
Finding

Unvalidated Working Directory and Permission Mode Are Typed into an Interactive Shell

Content
View full analysis
/dev/null; then log_warn "Session $session_name already exists" return 1 fi tmux -S "$SOCKET" new-session -d -s "$session_name" -x 120 -y 40 tmux -S "$SOCKET" send-keys -t "$session_name" "cd $workdir" Enter sleep 1 local permission_mode="${3:-acceptEdits}" tmux -S "$SOCKET" send-keys -t "$session_name" \ "claude --permission-mode $permission_mode" Enter sleep 3 if [ "$permission_mode" = "bypassPermissions" ]; then tmux -S "$SOCKET" send-keys -t "$session_name" "2" Enter sleep 3 fi tmux -S "$SOCKET" send-keys -t "$session_name" Enter } ``` ### Technical Analysis `workdir` and `permission_mode` are interpolated into strings that are typed into a live shell. Shell quoting at the `tmux` process boundary does not protect the text after it reaches the interactive shell. Characters such as semicolons, command substitutions, redirections, or newlines can become shell syntax. No canonical-path validation is applied to `workdir`, and `permission_mode` is not restricted to the modes documented by the helper. This is a command-construction vulnerability rather than ordinary argument passing. ### Attack Path 1. An attacker influences a call to the helper or driver, including the working-directory argument. 2. A value containing shell syntax is supplied, for example: ```text /tmp/project; attacker-command ``` 3. The helper types the following text into the tmux shell: ```bash cd /tmp/project; attacker-command ``` 4. The interactive shell parses the semicolon and executes the appended command. 5. The injecte ...[truncated 524 chars]
Remediation
View remediation
&2; return 1 ;; esac ``` 2. Disable `bypassPermissions` unless a separately controlled sandbox-only entry point is used. 3. Canonicalize `workdir`, verify that it exists and is a directory, and enforce an approved workspace root. 4. Use tmux's working-directory option rather than typing `cd` into a shell: ```bash tmux -S "$SOCKET" new-session -d -s "$session_name" -c "$workdir" ``` 5. Construct the Claude invocation with robust shell escaping, such as `printf '%q'`, if it must be sent as terminal text. 6. Prefer invoking a fixed wrapper script with arguments over constructing an interactive shell command. 7. Validate session names against a conservative character allowlist to reduce ambiguity in tmux target handling. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/monitor-task.sh:35
Finding

Predictable Temporary State Files Are Executed with Source

Content
View full analysis
"$state_file" <.state` containing shell code, for example: ```bash prev_lines=0 prev_timestamp=0 attacker_command ``` 3. A victim runs `monitor-task.sh check` for that session. 4. The script ...[truncated 669 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/init-project.sh:114
Finding

Project Name Validation Allows Workspace Path Traversal and Structured-File Injection

Content
View full analysis
.task-context/progress.json << EOF { "projectId": "$PROJECT_NAME", "projectName": "$PROJECT_NAME", "status": "pending", "currentPhase": "constitution", "phases": {}, "currentTask": {}, "artifacts": {}, "startTime": "$(date -Iseconds)", "lastUpdate": "$(date -Iseconds)", "checkpoints": [] } EOF ``` ### Technical Analysis The only project-name check verifies that the value is non-empty. Names containing `../`, absolute-path components, slashes, quotes, backslashes, or newlines are accepted. Because `PROJECT_DIR` is built by string concatenation, traversal components can resolve outside the selected workspace. The script subsequently creates directories, initializes Git and Speckit content, creates project files, and copies the constitution into the resolved location. The same value is written directly into a JSON heredoc. Quotes, newlines, and JSON control characters can corrupt the state file or inject additional JSON fields. The existing-directory check limits some overwrite scenarios, but it does not prevent the creation and population of a new attacker-selected directory outside the workspace. ### Attack Path 1. An attacker or unsafe caller supplies a project name containing traversal components, such as: ...[truncated 881 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
references/git-version-control.md:119
Finding

Autonomous Workflow Publishes Repository Content Without a Final Authorization Check

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (78)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

This finding indicates behavior beyond the declared development workflow, including local session log inspection, process/CPU monitoring, temporary state-file handling, and workspace enumeration. Those actions expand the skill into host inspection and persistence territory, which can expose sensitive local data and make the skill materially more dangerous than its stated purpose suggests.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This finding indicates behavior beyond the declared development workflow, including local session log inspection, process/CPU monitoring, temporary state-file handling, and workspace enumeration. Those actions expand the skill into host inspection and persistence territory, which can expose sensitive local data and make the skill materially more dangerous than its stated purpose suggests.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

The shell pipeline into sh is a command-chaining pattern that removes the opportunity to inspect downloaded content before execution. In this context it amplifies the risk of the external script fetch by turning network retrieval directly into code execution with a single command.

Content

Scanner excerpt · references/dependency-installation.md (reported line 107)May include surrounding context.

bash
# 安装
curl -LsSf https://astral.sh/uv/install.sh | sh

# 验证
uv --version

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The monitoring script parses error text to extract a module or command name and directly feeds it into pip install or apt-get install -y. Because error output is untrusted and can be influenced by code, prompts, or tool output, this grants arbitrary package installation capability and network access based on attacker-controlled strings.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This section combines autonomous monitoring, automatic pip/apt-get -y execution, and bypassPermissions mode without prominently flagging these as high-risk behaviors. The lack of warning is itself dangerous because it encourages unsafe operational practice that can lead to host compromise or uncontrolled system drift.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document explicitly recommends running Claude Code with --permission-mode bypassPermissions while piping its error stream into a function that performs pip install and apt-get install -y automatically. This creates an unbounded path from model/output-controlled text to privileged system modification without confirmation, which is far beyond a normal development workflow and can be abused to install arbitrary software or alter the host environment.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

git reset --hard HEAD~1 is a high-risk command because it forcibly rewrites the working tree and index to discard changes, which can permanently remove work if run by an agent or user without sufficient review. In this skill's context, the command is presented as a normal recovery option, making unsafe use more likely.

Content

Scanner excerpt · references/git-version-control.md (reported line 157)May include surrounding context.

md
|------|------|------|
| 撤销最近一次提交 | `git reset --soft HEAD~1` | 保留修改 |
| 恢复删除的文件 | `git checkout -- <file>` | 从最新提交恢复 |
| 回退到上一个版本 | `git reset --hard HEAD~1` | 丢弃修改（谨慎） |
| 查看历史记录 | `git log --oneline -10` | 最近 10 次提交 |

### 紧急恢复

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

git reset --hard <commit-hash> is especially dangerous because it can discard all local modifications and move the repository to an older state, potentially wiping substantial progress. In an autonomous workflow, an agent could execute this as a remediation step without fully understanding the consequences, causing severe data loss.

Content

Scanner excerpt · references/git-version-control.md (reported line 176)May include surrounding context.

git checkout -- .

4. 回退到上一个稳定版本

git reset --hard

text

---

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping network content directly into sudo ... bash creates immediate root-level arbitrary code execution with no inspection or integrity check. In an installation guide for a developer workflow, users are highly likely to copy-paste this command, making exploitation practical and severe.

Content

Scanner excerpt · references/installation.md (reported line 79)May include surrounding context.

Ubuntu/Debian：

bash
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt-get install -y nodejs

Chaining Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The curl ... | sh pattern chains remote retrieval directly into shell execution, enabling arbitrary code execution if the remote source is compromised. While not explicitly root here, it still grants code execution in the user's environment, which can expose credentials, source code, and local tooling.

Content

Scanner excerpt · references/installation.md (reported line 176)May include surrounding context.

5. 安装 UV（可选）

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

验证：

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/dependency-installation.md (reported line 140)May include surrounding context.

md
# 检查 Claude Code 配置
echo ""
echo -e "${BLUE}[Claude Code 配置]${NC}"
if [ -f ~/.claude/settings.json ]; then
    if grep -q "glm-5" ~/.claude/settings.json 2>/dev/null; then
        check_pass "GLM-5 模型已配置"
    else

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/installation.md (reported line 106)May include surrounding context.

md
# 检查 Claude Code 配置
echo ""
echo -e "${BLUE}[Claude Code 配置]${NC}"
if [ -f ~/.claude/settings.json ]; then
    if grep -q "glm-5" ~/.claude/settings.json 2>/dev/null; then
        check_pass "GLM-5 模型已配置"
    else

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/check-environment.sh (reported line 105)May include surrounding context.

sh
# 检查 Claude Code 配置
echo ""
echo -e "${BLUE}[Claude Code 配置]${NC}"
if [ -f ~/.claude/settings.json ]; then
    if grep -q "glm-5" ~/.claude/settings.json 2>/dev/null; then
        check_pass "GLM-5 模型已配置"
    else

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/check-environment.sh (reported line 106)May include surrounding context.

sh
# 检查 Claude Code 配置
echo ""
echo -e "${BLUE}[Claude Code 配置]${NC}"
if [ -f ~/.claude/settings.json ]; then
    if grep -q "glm-5" ~/.claude/settings.json 2>/dev/null; then
        check_pass "GLM-5 模型已配置"
    else

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/check-environment.sh (reported line 109)May include surrounding context.

sh
# 检查 Claude Code 配置
echo ""
echo -e "${BLUE}[Claude Code 配置]${NC}"
if [ -f ~/.claude/settings.json ]; then
    if grep -q "glm-5" ~/.claude/settings.json 2>/dev/null; then
        check_pass "GLM-5 模型已配置"
    else

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/check-environment.sh (reported line 111)May include surrounding context.

sh
# 检查 Claude Code 配置
echo ""
echo -e "${BLUE}[Claude Code 配置]${NC}"
if [ -f ~/.claude/settings.json ]; then
    if grep -q "glm-5" ~/.claude/settings.json 2>/dev/null; then
        check_pass "GLM-5 模型已配置"
    else

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/check-environment.sh (reported line 106)May include surrounding context.

sh
echo ""
echo -e "${BLUE}[Claude Code 配置]${NC}"
if [ -f ~/.claude/settings.json ]; then
    if grep -q "glm-5" ~/.claude/settings.json 2>/dev/null; then
        check_pass "GLM-5 模型已配置"
    else
        check_warn "GLM-5 模型未配置" "编辑 ~/.claude/settings.json 添加 ANTHROPIC_DEFAULT_*_MODEL"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/check-environment.sh (reported line 111)May include surrounding context.

sh
else
        check_warn "GLM-5 模型未配置" "编辑 ~/.claude/settings.json 添加 ANTHROPIC_DEFAULT_*_MODEL"
    fi
    if grep -q "bigmodel.cn" ~/.claude/settings.json 2>/dev/null; then
        check_pass "智谱 API 已配置"
    else
        check_warn "智谱 API 未配置" "运行 coding-helper auth glm_coding_plan_china <API_KEY>"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-project.sh (reported line 294)May include surrounding context.

sh
*.swo

# Environment
.env
.env.local

# Build

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-project.sh (reported line 295)May include surrounding context.

sh
# Environment
.env
.env.local

# Build
dist/

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The function sources /tmp/monitor-${session_id}.state, which executes the file as shell code rather than merely reading data from it. Because the path is in a world-writable temporary directory and the filename is derived from user-controllable input, a local attacker can plant or replace the state file and achieve arbitrary command execution when the monitoring script runs.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/monitor-task.sh (reported line 163)May include surrounding context.

sh
# 清理状态文件
cleanup_state() {
    rm -f /tmp/monitor-*.state
    log_info "已清理所有监控状态文件"
}

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script automatically answers permission prompts by sending '1' (Yes) whenever it detects 'Do you want to proceed?'. In a workflow that drives Claude Code and performs implementation actions, this removes human approval from potentially sensitive operations, allowing unintended file modifications, command execution, or other privileged actions to proceed without user awareness.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · templates/constitution-enterprise.md (reported line 56)May include surrounding context.

from pydantic import BaseModel, ConfigDict

class Settings(BaseModel): model_config = ConfigDict(env_file='.env')

text
- ✅ SQLAlchemy 2.0：使用 `Mapped` 和 `mapped_column`
- ✅ FastAPI：使用最新稳定版本的依赖注入模式

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill embeds numerous shell commands and operational workflows but does not declare any explicit tool scope such as allowed shell access or permissions boundaries. This increases the chance that an agent will execute filesystem, git, network, or package-management actions without transparent guardrails, especially in an automation-oriented skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.