Claude Delegate

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:53 PM UTC
• Version: 1.0.0

Overview

This skill openly delegates coding work to Claude Code, but it makes disabled permission checks the default for broad coding requests without clear safeguards.

Review carefully before installing. Use this only when you deliberately want to delegate work to Claude Code, and avoid the documented bypass-permissions command for ordinary tasks. Prefer explicit opt-in, a tightly scoped working directory, normal permission prompts, and argument-safe invocation rather than interpolating task text into a shell command.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:12
• Finding: Delegated Claude Execution Disables Permission Enforcement## Vulnerability Details **File Location**: `SKILL.md`, lines 12-16 **Vulnerability Type**: Unauthorized access and privilege escalation through disabled permission checks **Risk Level**: High **Vulnerable Code**: ```markdown ## Usage To delegate a task to Claude Code, use the `exec` tool with the `bash` command, specifying the working directory and the task as a string. Claude Code will run with `--print --permission-mode bypassPermissions` automatically. ```bash bash workdir:/path/to/project command:"claude --permission-mode bypassPermissions --print 'your coding task here'" ``` ``` ### Technical Analysis The skill explicitly instructs the agent to invoke Claude Code with `--permission-mode bypassPermissions`. This option removes the delegated agent's normal permission and confirmation boundary. Consequently, delegated tasks may use every filesystem and command-execution capability available to the parent process without requiring approval. Routine code generation, review, and refactoring generally do not require globally bypassing permission checks. Applying this option to every invocation violates least privilege and substantially increases the consequences of malicious prompts, ambiguous instructions, prompt injection in project files, or mistakes made by the delegated agent. ### Attack Path 1. An attacker submits a coding task or places adversarial instructions in files that the delegated agent is asked to inspect. 2. The parent agent follows the skill and launches Claude Code with `--permission-mode bypassPermissions`. 3. The delegated process interprets the attacker-controlled instructions as requiring sensitive filesystem operations or command execution. 4. Those operations execute without an interactive approval check. 5. The attacker may thereby affect resources accessible to the parent process, including files outside the intended project if operating-system controls permit access. ### Impact Assess ...[truncated 506 chars]
• Remediation: ## Remediation Suggestions - Remove `--permission-mode bypassPermissions` and use Claude Code's default permission model. - Require explicit approval for command execution, writes, deletion, and access outside the designated project directory. - Restrict delegated processes to a dedicated working directory with minimal operating-system permissions. - Run delegated work in a sandbox or container without access to user credentials, SSH material, unrelated repositories, or sensitive host paths. - Where supported, define a narrow allowlist of tools and operations required for each task instead of granting unrestricted capabilities. - Treat repository contents and delegated task text as untrusted input, particularly during code review and file exploration.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:14
• Finding: Shell Command Injection Through Unescaped Task Interpolation## Vulnerability Details **File Location**: `SKILL.md`, lines 14-16 **Vulnerability Type**: Shell command injection **Risk Level**: High **Vulnerable Code**: ```markdown ```bash bash workdir:/path/to/project command:"claude --permission-mode bypassPermissions --print 'your coding task here'" ``` ``` ### Technical Analysis The documented command places the coding task inside single quotes within a shell command string. The skill does not require shell escaping, input validation, or an argument-array execution interface. If untrusted task text is substituted directly for `your coding task here`, a single quote can terminate the intended argument. Shell metacharacters can then introduce additional commands. For example, task text shaped like the following would break out of the quoted argument if directly interpolated: ```text review this'; attacker-controlled-command; echo ' ``` The shell would parse `attacker-controlled-command` as a separate command rather than as part of the prompt passed to Claude. This is a direct execution path that does not depend on the delegated model choosing to follow the malicious text. ### Attack Path 1. An attacker supplies a coding-task string containing a single quote, shell separators, and an attacker-selected command. 2. The invoking agent substitutes that string into the documented `command:"claude ... --print '...'"` template without robust shell escaping. 3. The injected single quote closes the prompt argument. 4. Shell control operators cause the appended text to be parsed as one or more additional commands. 5. The shell executes the injected command with the privileges and environment of the process running the skill. Exploitability depends on the implementation following the documented string-interpolation pattern. Using an execution API that passes arguments directly without a shell would prevent this attack. ### Impact Assessment Successful exploitation permits ...[truncated 398 chars]
• Remediation: ## Remediation Suggestions - Do not construct shell command strings by concatenating or interpolating task text. - Invoke Claude through an execution API that accepts an argument array, passing the task as a distinct argument without shell parsing. - If a shell cannot be avoided, use a well-tested shell-quoting routine rather than manual quoting. - Prefer supplying large or complex prompt content through standard input so it is never interpreted as command syntax. - Validate task input and reject unexpected control characters as defense in depth, while recognizing that validation is not a substitute for argument-safe execution. - Add tests containing single quotes, command separators, command substitutions, newlines, and redirection characters to verify that all task content remains one literal argument. - Combine this correction with removal of `--permission-mode bypassPermissions` to reduce the impact of any remaining execution flaw.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The documentation explicitly instructs users to run Claude Code with '--permission-mode bypassPermissions' and presents it as the standard command path without any warning, restriction, or approval gate. This is dangerous because it normalizes execution with safety controls disabled, allowing delegated prompts to perform sensitive file or system actions with reduced user oversight.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill advertises very broad trigger phrases such as 'write code', 'fix this bug', 'refactor', and 'debug', which overlap with normal development requests and can cause the skill to activate in many routine contexts. Because the skill then delegates execution to an external coding agent with elevated permissions, accidental invocation can expand the blast radius of ordinary prompts into unsupervised code actions.

Static analysis

No suspicious patterns detected.