Aegis Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 0.6.7

Overview

The skill is broadly coherent for local Claude Code orchestration, but it includes under-scoped automation that can auto-approve shell and permission requests and installs a persistent unpinned MCP executable.

Review carefully before installing. Prefer project-scoped MCP setup, pin the `aegis-bridge` package version, and do not use the heartbeat template's auto-approval behavior unless the session is sandboxed and commands are allowlisted. Treat transcripts, prompts, memory entries, and repository context as sensitive data handled by the local Aegis service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup-mcp.sh:21

Finding

Unpinned npm Package Persistently Registered as an MCP Executable

Content

View full analysis

Vulnerability Details

File Location: scripts/setup-mcp.sh:21-23, 39-43
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

bash

if command -v claude &>/dev/null; then
  if [ "$SCOPE" = "user" ]; then
    claude mcp add --scope user aegis -- npx aegis-bridge mcp --port "$PORT"
  else
    claude mcp add --scope project aegis -- npx aegis-bridge mcp --port "$PORT"
  fi

The direct-configuration fallback registers the same unpinned package:

bash

jq --arg port "$PORT" '
  .mcpServers = (.mcpServers // {}) |
  .mcpServers.aegis = {
    "command": "npx",
    "args": ["aegis-bridge", "mcp", "--port", $port]
  }
' "$CONFIG_FILE" > "$TMP" && mv "$TMP" "$CONFIG_FILE"

Technical Analysis

The setup script registers npx aegis-bridge without an exact package version, lockfile, integrity hash, or local-only resolution requirement. When Claude Code starts the configured MCP server, npx may resolve and download the package from the configured npm registry.

Consequently, the code executed in the future is not necessarily the same code that existed when this project was audited. A compromised release, package takeover, registry compromise, or unexpected incompatible update could introduce attacker-controlled behavior.

User-scoped installation writes this executable configuration into ~/.claude/settings.json, making the dependency available across subsequent Claude Code sessions. This persistence magnifies the effect of a later supply-chain compromise, although there is no evidence that the package is currently malicious.

Attack Path

1. An attacker compromises the aegis-bridge npm package, its publisher account, or the package distribution channel.
2. The attacker publishes a malicious release under the same unversioned package name.
3. A user runs this setup script, or an existing MCP configuration later starts without ...[truncated 1014 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin aegis-bridge to a reviewed, exact version rather than resolving an unversioned package name.
2. Install it as a lockfile-managed local dependency and invoke it with npx --no-install, or reference a trusted local executable directly.
3. Commit and verify the relevant lockfile and package integrity metadata.
4. Prefer project-scoped configuration so the executable is not automatically exposed to unrelated repositories.
5. Clearly disclose that user-scoped setup changes ~/.claude/settings.json, and provide a command for removing the MCP registration.
6. Apply controlled dependency-update review and test the package before advancing the pinned version.
7. Where feasible, run the MCP server with restricted filesystem, environment, and network permissions.

T09 · Insecure Skill Coding Practices

Error

• Location: references/heartbeat-template.md:51

Finding

Heartbeat Workflow Automatically Approves Shell and Permission Requests

Content

View full analysis

Vulnerability Details

File Location: references/heartbeat-template.md:51-65
Vulnerability Type: Unconditional authorization of agent permission and shell-execution requests
Risk Level: High

Vulnerable Code

bash

    permission_prompt|bash_approval)
      echo "Approving permission prompt."
      curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/approve
      ;;
    plan_mode)
      echo "Approving plan (option 1)."
      curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/approve
      ;;
    ask_question)
      QUESTION=$(echo "$RESP" | jq -r '.messages[-1].text' 2>/dev/null)
      echo "Agent asks: $QUESTION"
      # Default: approve. Customize per use case.
      curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
        -H "Content-Type: application/json" \
        -d '{"text":"Proceed with your best judgment."}'
      ;;

The behavior is also promoted as an end-to-end workflow in references/workflow-examples.md:7-9:

markdown

1. Create session with issue prompt.
2. Poll status with heartbeat loop.
3. Auto-approve permission prompts.
4. Read summary and transcript tail.

Technical Analysis

The heartbeat loop treats permission_prompt and bash_approval identically and invokes the approval endpoint based solely on the status value. It does not retrieve and verify the exact shell command, requested path, target resource, or permission scope before granting authorization.

The workflow therefore removes the human safety boundary intended to prevent an autonomous agent from executing dangerous commands or accessing resources outside its legitimate task. Plan-mode approval is also unconditional, while questions receive a generic instruction to proceed using the agent's judgment.

This is exploitable when an agent processes attacker-controlled repository files, issue text, build output, dependency content, or other prompt-injection s ...[truncated 1651 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the default behavior for bash_approval and sensitive permission requests to reject or pause for explicit human review.
2. Retrieve and display the complete requested command, arguments, working directory, affected paths, and permission scope before authorization.
3. Handle shell approvals separately from low-risk prompts; never use a shared unconditional approval branch.
4. Implement strict allowlists for commands, executable paths, arguments, working directories, filesystem targets, and network destinations.
5. Reject shell metacharacters, command substitution, redirection, pipelines, encoded payloads, destructive operations, and access outside the approved workspace unless separately reviewed.
6. Require an explicit opt-in flag for any automated approval mode and prominently document its risk.
7. Run sessions in a sandbox with a minimal environment, restricted credentials, workspace-only filesystem access, and limited network access.
8. Replace the generic Proceed with your best judgment. response with a human decision or a narrowly scoped, policy-validated answer.
9. Update references/workflow-examples.md so it does not recommend automatic approval as the standard workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Yes, this is a mismatch. The description claims the skill orchestrates Claude Code sessions, spawns sessions, and supports multi-agent workflows through the Aegis bridge. The actual code chunk does not perform any orchestration, session creation, task dispatch, or agent coordination. Instead, it is a supporting diagnostic script that checks Aegis server health and whether MCP configuration exists. While this is related to the same ecosystem and localhost:9100 resource, its primary purpose is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents the skill as an operational orchestrator for creating and managing Claude Code sessions and multi-agent workflows. However, the supplied code only performs local setup: it registers an MCP server named 'aegis' in Claude Code configuration files or via the Claude CLI. It does not start sessions, route tasks, review PRs, fix CI, or orchestrate agents. While this setup supports the broader Aegis integration, the code chunk's primary purpose is installation/configuration, which is materially different from the declared runtime orchestration behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented /v1/sessions/:id/bash endpoint enables remote execution of arbitrary shell commands in Claude Code sessions. In the context of an orchestration bridge running on localhost and designed to spawn coding agents, documenting this capability without prominent safety constraints normalizes a highly dangerous primitive that can lead to arbitrary code execution, file tampering, secret access, or destructive system actions if exposed or misused.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-quick-ref.md (reported line 152)May include surrounding context.

md

| `get_status` | `GET /v1/sessions/:id` + `/health` |
| `get_transcript` | `GET /v1/sessions/:id/read` |
| `send_message` | `POST /v1/sessions/:id/send` |
| `kill_session` | `DELETE /v1/sessions/:id` |
| `approve_permission` | `POST /v1/sessions/:id/approve` |
| `reject_permission` | `POST /v1/sessions/:id/reject` |
| `escape_session` | `POST /v1/sessions/:id/escape` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-quick-ref.md (reported line 170)May include surrounding context.

md

| `server_health` | `GET /v1/health` |
| `state_set` | `POST /v1/memory` |
| `state_get` | `GET /v1/memory/{key}` |
| `state_delete` | `DELETE /v1/memory/{key}` |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/heartbeat-template.md (reported line 41)May include surrounding context.

md

STALLED=$((ELAPSED - STALL_START))
        if [ "$STALLED" -gt "$STALL_THRESHOLD" ]; then
          echo "STALL detected (${STALLED}s without progress). Sending nudge."
          curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
            -H "Content-Type: application/json" \
            -d '{"text":"Continue. What is blocking you?"}'
          STALL_START=$ELAPSED  # reset stall timer

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup-mcp.sh (reported line 3)May include surrounding context.

sh

#!/usr/bin/env bash
# Configure Aegis MCP server in Claude Code settings.
# Adds an "aegis" MCP entry to ~/.claude/settings.json or project .mcp.json.
set -euo pipefail

SCOPE="${1:-user}"

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/health-check.sh (reported line 33)May include surrounding context.

sh

if [ "$SCOPE" = "project" ]; then
  CONFIG_FILE=".mcp.json"
else
  CONFIG_FILE="$HOME/.claude/settings.json"
  mkdir -p "$(dirname "$CONFIG_FILE")"
fi

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup-mcp.sh (reported line 12)May include surrounding context.

sh

if [ "$SCOPE" = "project" ]; then
  CONFIG_FILE=".mcp.json"
else
  CONFIG_FILE="$HOME/.claude/settings.json"
  mkdir -p "$(dirname "$CONFIG_FILE")"
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly instructs use of shell commands, HTTP requests, and repository-affecting workflows, but it does not declare an explicit tool scope or permission boundary. That increases the chance an agent or user invokes powerful actions without clear least-privilege constraints or review expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill sends prompts and repository context to a local HTTP/MCP bridge and reads/stores transcripts, but it provides no privacy or retention warning. Even on localhost, sensitive source code, secrets, or proprietary task context may be transmitted to another service and persisted outside the user's expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

## Prerequisites

1. Aegis server running: `curl -s http://127.0.0.1:9100/v1/health`
2. MCP configured (optional, for native tool access): see [scripts/setup-mcp.sh](scripts/setup-mcp.sh)
3. Verify health: `bash scripts/health-check.sh`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

This endpoint sends arbitrary user task text to the Aegis bridge, which may include sensitive repository context, credentials, or proprietary instructions. In the context of an orchestration skill, this is expected behavior, but it is still a real data-transmission risk if users are not warned and if the local bridge is not properly secured.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

MCP: send_message(sessionId, text) HTTP:

bash

curl -s -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
  -H "Content-Type: application/json" \
  -d '{"text":"Your task here"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill normalizes approving permission prompts for trust-folder, tool use, bash approvals, and plan-mode actions, yet it does not prominently warn that these approvals can lead to command execution and repository modification. Users may approve dangerous actions without understanding that the downstream CC session can alter code, files, or local system state.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 76% confidence

Finding

Reading transcripts from the local bridge exposes potentially sensitive prompts, outputs, and repository-derived content through another interface. If the bridge is accessible by other local users or processes, transcript retrieval can become a confidentiality issue.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

### Step 5: Read Transcript

**MCP**: `get_transcript(sessionId)`
**HTTP**: `curl -s http://127.0.0.1:9100/v1/sessions/$SID/read`

Returns `{ messages[], status, statusText }`. Each message: `{ role, contentType, text, timestamp }`.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented shared state features introduce persistence and cross-session data sharing beyond the core stated role of simple session orchestration. Without strong purpose limitation and data-handling guidance, this can enable unintended retention or leakage of prompts, repository details, or other sensitive workflow context across sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes using an Aegis bridge to create and manage Claude Code sessions for coding workflows. The advanced tools list_pipelines, create_pipeline, and get_swarm add higher-level workflow/pipeline management capabilities that go beyond a straightforward session bridge and are not clearly justified by the stated purpose.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file documents a destructive operation, DELETE /v1/sessions/:id, with only the terse description 'Kill session' and no warning about terminating active work or losing access to the session afterward. For markdown files, the skill description should warn about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

DELETE /v1/memory/{key} removes stored state, but the documentation does not warn that the operation deletes persisted data and may be irreversible. Markdown guidance should disclose destructive behaviors that affect user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented DELETE /v1/templates/:id endpoint deletes a template, yet no warning is provided about permanent removal or downstream effects on workflows relying on that template. This is a user-data-affecting action that should be disclosed in markdown documentation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/heartbeat-template.md (reported line 41)May include surrounding context.

md

STALLED=$((ELAPSED - STALL_START))
        if [ "$STALLED" -gt "$STALL_THRESHOLD" ]; then
          echo "STALL detected (${STALLED}s without progress). Sending nudge."
          curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
            -H "Content-Type: application/json" \
            -d '{"text":"Continue. What is blocking you?"}'
          STALL_START=$ELAPSED  # reset stall timer

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/heartbeat-template.md (reported line 63)May include surrounding context.

md

STALLED=$((ELAPSED - STALL_START))
        if [ "$STALLED" -gt "$STALL_THRESHOLD" ]; then
          echo "STALL detected (${STALLED}s without progress). Sending nudge."
          curl -sf -X POST http://127.0.0.1:9100/v1/sessions/$SID/send \
            -H "Content-Type: application/json" \
            -d '{"text":"Continue. What is blocking you?"}'
          STALL_START=$ELAPSED  # reset stall timer

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The template explicitly auto-approves permission prompts and plan prompts, removing the human-in-the-loop safeguard for actions the agent itself has flagged as requiring approval. In this skill's context—remote orchestration of coding agents that may run shell commands or modify repositories—this can allow unintended or unsafe actions to proceed automatically without user review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Responding to all agent questions with 'Proceed with your best judgment' grants broad implicit authorization and suppresses important clarification points. In an autonomous dev-loop, this can cause the agent to take irreversible or risky actions when it should instead pause for operator input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.