Aegis Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 0.1.0

Overview

The skill mostly does what it says, but it encourages unattended approval of coding-agent permissions and installs an unpinned persistent MCP command, which users should review carefully before installing.

Review this skill before installing. Prefer project-scoped MCP setup over user-scoped setup, pin or locally verify the `aegis-bridge` executable instead of relying on bare `npx`, and do not use the provided auto-approval heartbeat template unless it runs in a tightly isolated environment with explicit allowlists and audit logging. Treat prompts, transcripts, raw terminal output, and approval requests as sensitive.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/setup-mcp.sh:18
• Finding: Unpinned npm Package Persisted as an MCP Executable<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-mcp.sh:18-24` and `scripts/setup-mcp.sh:38-44` **Vulnerability Type**: Unpinned runtime dependency execution **Risk Level**: High ### Vulnerable Code ```bash # Use claude mcp add if available if command -v claude &>/dev/null; then if [ "$SCOPE" = "user" ]; then claude mcp add --scope user aegis -- npx aegis-bridge mcp --port "$PORT" else claude mcp add --scope project aegis -- npx aegis-bridge mcp --port "$PORT" fi ``` The fallback configuration creates the same unpinned command: ```bash jq --arg port "$PORT" ' .mcpServers = (.mcpServers // {}) | .mcpServers.aegis = { "command": "npx", "args": ["aegis-bridge", "mcp", "--port", $port] } ' "$CONFIG_FILE" > "$TMP" && mv "$TMP" "$CONFIG_FILE" ``` ### Technical Analysis The setup script registers the bare npm package name `aegis-bridge` as an MCP executable through `npx`. It does not specify an exact package version, integrity hash, lockfile, verified registry, or trusted local installation path. The resulting command is stored in either the user-level Claude configuration or the project-level MCP configuration. Subsequent MCP launches can therefore resolve package content that was not included in, or reviewed as part of, this project. The effective executable may change when a new package release is published or if the package registry, publisher account, or dependency chain is compromised. Because an MCP server is a locally executed process, resolved package code runs with the privileges of the user launching Claude Code. This is materially more dangerous than using an unpinned library solely for build-time development. ### Attack Path 1. A user runs `scripts/setup-mcp.sh` with either user or project scope. 2. The script stores `npx aegis-bridge mcp --port ...` in Claude’s MCP configuration. 3. An attacker compromises the `aegis-bridge` npm package, its publisher account, registry resolution, or one of its tr ...[truncated 1179 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `aegis-bridge` to an audited exact version rather than invoking a bare package name. 2. Install dependencies from a committed lockfile using a reproducible command such as `npm ci`. 3. Configure MCP to execute a verified local binary using an absolute path, rather than resolving a package dynamically through `npx`. 4. Verify the package integrity through npm integrity metadata or an independently maintained checksum. 5. Configure an explicit trusted registry and prevent fallback to unexpected package sources. 6. Review and pin all transitive dependencies used by the MCP server. 7. Document how users can remove the MCP entry and provide an uninstall script. 8. If `npx` must be retained, use an exact package version and disable interactive or implicit installation behavior where possible. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/heartbeat-template.md:51
• Finding: Heartbeat Automation Blindly Approves Permission and Bash Execution Prompts<![CDATA[ ## Vulnerability Details **File Location**: `references/heartbeat-template.md:51-65`; explicitly recommended by `references/workflow-examples.md:5-9` **Vulnerability Type**: Permission-boundary bypass through unattended approval **Risk Level**: High ### Vulnerable Code ```bash permission_prompt|bash_approval) echo "Approving permission prompt." curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/approve ;; plan_mode) echo "Approving plan (option 1)." curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/approve ;; ask_question) QUESTION=$(echo "$RESP" | jq -r '.messages[-1].text' 2>/dev/null) echo "Agent asks: $QUESTION" # Default: approve. Customize per use case. curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \ -H "Content-Type: application/json" \ -d '{"text":"Proceed with your best judgment."}' ;; ``` The workflow documentation explicitly recommends this behavior: ```markdown ## 1) Implement Issue 1. Create session with issue prompt. 2. Poll status with heartbeat loop. 3. Auto-approve permission prompts. 4. Read summary and transcript tail. ``` ### Technical Analysis The heartbeat template handles `permission_prompt` and `bash_approval` through the same unconditional `/approve` request. It does not retrieve or validate the requested command, inspect affected paths, distinguish read-only operations from destructive operations, apply an allowlist, or require human confirmation. A permission prompt is a security boundary intended to prevent an Agent from executing sensitive tools or shell commands without authorization. Automatically approving every prompt removes that boundary. The behavior is especially dangerous in workflows that process untrusted repository content, issue descriptions, pull requests, build scripts, test fixtures, or generated tool output. The `ask_question` branch further delegates unresolved decisions to the ...[truncated 2201 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace automatic approval with a secure default that pauses and requires explicit human confirmation. 2. Treat `bash_approval` separately from ordinary permission prompts; never approve arbitrary shell commands solely from the status value. 3. Retrieve and display the complete pending command, requested tool, working directory, and affected paths before asking for approval. 4. Implement strict allowlists for commands, tools, arguments, destination hosts, and writable directories. 5. Automatically reject commands involving credential locations, external uploads, package installation, privilege escalation, destructive file operations, or execution outside the configured repository. 6. Run automated sessions in an isolated container or sandbox with: - A dedicated unprivileged user - A restricted writable workspace - No host credentials - Minimal environment variables - Restricted outbound network access 7. Replace `Proceed with your best judgment.` with a pause requiring a specific operator-provided answer for security-sensitive questions. 8. Require an explicit command-line option such as `--unsafe-auto-approve` before enabling unattended approval, accompanied by a prominent warning. 9. Record approval decisions, command text, timestamps, and session identifiers in an audit log. 10. Update `references/workflow-examples.md` so that human review or policy-based rejection is the documented default. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description presents the skill as an orchestration tool for creating and managing Claude Code sessions via Aegis. However, the supplied code does not orchestrate sessions or interact with Claude Code tasks beyond checking readiness. Its actual purpose is to verify that the Aegis server is reachable at /v1/health and to perform a best-effort MCP configuration presence check in local files. This is a materially different primary purpose from session spawning/orchestration, so the description does not accurately represent the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents the skill as an orchestration tool for spawning and managing Claude Code sessions through Aegis. However, the provided code does not orchestrate sessions, create agents, review PRs, fix CI, or perform any workflow actions. Its sole function is setup/configuration: registering an MCP server named 'aegis' in Claude Code settings. That is materially different from the declared primary purpose. While configuration may support the described workflow, the code chunk itself implements only installation/setup behavior, so the description does not accurately represent the actual behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| `get_status` | `GET /v1/sessions/:id` + `/health` |
| `get_transcript` | `GET /v1/sessions/:id/read` |
| `send_message` | `POST /v1/sessions/:id/send` |
| `kill_session` | `DELETE /v1/sessions/:id` |
| `approve_permission` | `POST /v1/sessions/:id/approve` |
| `reject_permission` | `POST /v1/sessions/:id/reject` |
| `escape_session` | `POST /v1/sessions/:id/escape` |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

STALLED=$((ELAPSED - STALL_START))
        if [ "$STALLED" -gt "$STALL_THRESHOLD" ]; then
          echo "STALL detected (${STALLED}s without progress). Sending nudge."
          curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
            -H "Content-Type: application/json" \
            -d '{"text":"Continue. What is blocking you?"}'
          STALL_START=$ELAPSED  # reset stall timer

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

fi

# Best-effort MCP config check
USER_CFG="$HOME/.claude/settings.json"
PROJECT_CFG=".mcp.json"
HAS_MCP=0

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

#!/usr/bin/env bash
# Configure Aegis MCP server in Claude Code settings.
# Adds an "aegis" MCP entry to ~/.claude/settings.json or project .mcp.json.
set -euo pipefail

SCOPE="${1:-user}"

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

if [ "$SCOPE" = "project" ]; then
  CONFIG_FILE=".mcp.json"
else
  CONFIG_FILE="$HOME/.claude/settings.json"
  mkdir -p "$(dirname "$CONFIG_FILE")"
fi

• Confidence: 90% confidence
• Finding: This code writes to `$HOME/.claude/settings.json`, modifying a user-wide Claude Code configuration file to add a new MCP server entry. While this is the stated purpose of the setup script and not inherently malicious, it changes a trusted config location that can cause future automatic execution of the configured command, increasing persistence and trust-boundary risk if the package or bridge is compromised.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs use of shell commands and system-affecting operations, but it does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens policy transparency and increases the chance the skill is invoked in contexts where shell/network-capable behavior is broader than intended.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Broad trigger phrases like 'aegis', 'parallel agents', and 'send to CC' can cause accidental invocation in unrelated contexts, increasing the chance that session orchestration, shell commands, or permission-handling guidance is surfaced when not intended. For a skill that can lead to command execution and approval of actions, over-broad activation materially raises misuse risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Prerequisites

1. Aegis server running: `curl -s http://127.0.0.1:9100/v1/health`
2. MCP configured (optional, for native tool access): see [scripts/setup-mcp.sh](scripts/setup-mcp.sh)
3. Verify health: `bash scripts/health-check.sh`

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**MCP**: `send_message(sessionId, text)`
**HTTP**:
```bash
curl -s -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
  -H "Content-Type: application/json" \
  -d '{"text":"Your task here"}'
```

• Confidence: 78% confidence
• Finding: This transmits arbitrary task text to a local HTTP service that brokers Claude Code sessions, potentially including sensitive source code, secrets, or internal instructions. Although the destination is localhost and aligned with the skill's purpose, the skill does not include guidance to minimize sensitive data exposure or verify the local bridge's trustworthiness.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs operators to approve permission prompts, bash approvals, and trust-folder actions as part of normal workflow without an upfront safety warning or strict decision criteria. This can normalize unsafe approvals and lead to arbitrary command execution, workspace trust changes, or other system-impacting actions being authorized too casually.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 5: Read Transcript

**MCP**: `get_transcript(sessionId)`
**HTTP**: `curl -s http://127.0.0.1:9100/v1/sessions/$SID/read`

Returns `{ messages[], status, statusText }`. Each message: `{ role, contentType, text, timestamp }`.

• Confidence: 81% confidence
• Finding: Reading full transcripts from the local bridge can expose sensitive code, credentials, command output, and user inputs to whatever process or operator is invoking the skill. In this context transcript access is part of core functionality, but without safeguards it expands the exposure surface for sensitive session data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The template explicitly tells agents to commit changes when done, but it does not require user approval, a review checkpoint, or any warning that commits are state-changing actions. In an orchestration skill designed to spawn coding agents, this increases the risk of unauthorized or premature repository mutations, especially when combined with broad implementation scopes.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The quick reference documents high-risk endpoints for arbitrary bash execution, slash-command execution, session interruption, approval, and deletion without any adjacent warnings, authorization notes, or operator-safety guidance. In the context of an orchestration skill that can spawn and control Claude Code sessions, this normalizes dangerous actions and increases the chance that downstream agents or users invoke destructive capabilities without understanding their impact.

External Transmission

Medium

• Category: Data Exfiltration

Content

STALLED=$((ELAPSED - STALL_START))
        if [ "$STALLED" -gt "$STALL_THRESHOLD" ]; then
          echo "STALL detected (${STALLED}s without progress). Sending nudge."
          curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
            -H "Content-Type: application/json" \
            -d '{"text":"Continue. What is blocking you?"}'
          STALL_START=$ELAPSED  # reset stall timer

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The template automatically approves permission prompts and plan-mode decisions without any trust check, user confirmation, or command inspection. In a workflow that drives an autonomous coding agent, this can authorize file modifications, command execution, or other sensitive actions that a human would normally review, materially increasing the risk of unsafe or unintended operations.

External Transmission

Medium

• Category: Data Exfiltration

Content

QUESTION=$(echo "$RESP" | jq -r '.messages[-1].text' 2>/dev/null)
      echo "Agent asks: $QUESTION"
      # Default: approve. Customize per use case.
      curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
        -H "Content-Type: application/json" \
        -d '{"text":"Proceed with your best judgment."}'
      ;;

• Confidence: 87% confidence
• Finding: This sends an unconditional reply of 'Proceed with your best judgment' whenever the agent asks a question, bypassing human review at the point where the agent explicitly needs clarification or approval. In context, this increases unsafe autonomy and can cause the agent to continue with risky assumptions, including sensitive changes or commands the operator never intended.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `MAX_WAIT` | 600s | Maximum time before timeout |
| `POLL_INTERVAL` | 5s | How often to check status |
| `STALL_THRESHOLD` | 150s | Time without progress before nudging |
| Permission handling | Auto-approve | Change to log/reject for untrusted commands |

• Confidence: 95% confidence
• Finding: Documenting permission handling as 'Auto-approve' normalizes unsafe autonomous authorization in a tool specifically designed to orchestrate coding-agent sessions. In this context, operators may adopt the insecure default and unknowingly allow execution or approval of actions that should require human scrutiny.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Create session with issue prompt.
2. Poll status with heartbeat loop.
3. Auto-approve permission prompts.
4. Read summary and transcript tail.

```bash

• Confidence: 95% confidence
• Finding: The example promotes autonomous approval of permission prompts, effectively delegating trust decisions to automation without operator validation. In a multi-agent workflow tool, this materially increases risk because the spawned session may request capabilities that enable code changes, command execution, or access to sensitive data, and automatic approval bypasses the intended guardrail.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The workflow explicitly instructs users to auto-approve permission prompts, removing a key human safety checkpoint before privileged or potentially destructive actions. In an orchestration skill that spawns and drives coding agents, this can let an agent perform filesystem, network, or code-modifying operations without meaningful review, increasing the chance of unsafe changes or abuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

4. Read summary and transcript tail.

```bash
SID=$(curl -s -X POST http://127.0.0.1:9100/v1/sessions \
  -H "Content-Type: application/json" \
  -d '{
    "workDir": "/repo/aegis",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

4. Read summary and transcript tail.

```bash
SID=$(curl -s -X POST http://127.0.0.1:9100/v1/sessions \
  -H "Content-Type: application/json" \
  -d '{
    "workDir": "/repo/aegis",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

4. Read summary and transcript tail.

```bash
SID=$(curl -s -X POST http://127.0.0.1:9100/v1/sessions \
  -H "Content-Type: application/json" \
  -d '{
    "workDir": "/repo/aegis",

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.