Claude Code Agent SDK

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.1

Overview

This documentation-only skill is coherent, but it needs review because copyable examples promote high-impact agent automation and unpinned tool execution without consistently adjacent safety guardrails.

Review this before installing if users may copy examples into real projects. Pin MCP package versions, avoid npx @latest and broad wildcards, keep Bash and bypassPermissions out of production unless isolated, scope tokens and filesystem access narrowly, and protect or disable session persistence and telemetry for sensitive work.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/mcp.md:28

Finding

Unpinned MCP Packages Are Downloaded and Executed Through npx

Content

View full analysis

Remediation

View remediation

", "/Users/me/projects" ] } } ``` 2. Replace `@playwright/mcp@latest` with an exact version. Do not use `latest`, caret ranges, tilde ranges, or other mutable version selectors for automatically executed tools. 3. Prefer installing MCP packages during a controlled build step rather than resolving them dynamically when the agent starts. Commit the relevant lockfile and verify package integrity. 4. Use a private or allowlisted package registry where appropriate, with provenance, signature, and integrity verification enabled. 5. Run each MCP server in an isolated container or restricted subprocess with: - A dedicated low-privilege operating-system identity. - Read-only mounts wherever possible. - Access only to the specific required project subtree. - An explicit outbound-network allowlist. - CPU, memory, process, and execution-time limits. 6. Pass only the credentials required by that MCP server. Avoid inheriting the complete parent environment. 7. Scope `GITHUB_TOKEN` to the minimum repositories and operations required, use short-lived tokens, and rotate the token if package compromise is suspected. 8. Avoid broad MCP wildcard approval where possible. Allow only specific reviewed operations instead of `mcp__server__*`. 9. Document an explicit package-review and update procedure so upgrades are tested and approved before the pinned version is changed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/file-checkpointing.md (reported line 115)May include surrounding context.

CLI Rewind

bash

claude -p --resume <session-id> --rewind-files <checkpoint-uuid>

Notes

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/hooks.md (reported line 56)May include surrounding context.

Block dangerous operations:

python

async def protect_env(input_data, tool_use_id, context):
    if input_data["tool_input"].get("file_path") == ".env":
        return {"hookSpecificOutput": {
            "hookEventName": input_data["hook_event_name"],
            "permissionDecision": "deny",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/hooks.md (reported line 60)May include surrounding context.

return {"hookSpecificOutput": { "hookEventName": input_data["hook_event_name"], "permissionDecision": "deny", "permissionDecisionReason": "Cannot modify .env files" }} return {}

text

MCP Config Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · references/mcp.md (reported line 109)May include surrounding context.

}

text

`.mcp.json` uses `${GITHUB_TOKEN}` syntax.

### HTTP Headers

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp.md (reported line 125)May include surrounding context.

md

### OAuth2

The SDK does not automatically handle OAuth flows. Complete OAuth in your application, then pass the access token via headers.

## Tool Search

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/claude-code-features.md (reported line 65)May include surrounding context.

}

text

- Skills must be created as filesystem artifacts (`.claude/skills/<name>/SKILL.md`)
- The Skill tool is automatically enabled when `skills` is set in SDK options

## Hooks

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/custom-tools.md (reported line 42)May include surrounding context.

md

},
  async (args) => {
    // args typed from schema: { latitude: number; longitude: number }
    const response = await fetch(`https://api.open-meteo.com/v1/forecast?...`);
    const data = await response.json();
    return { content: [{ type: "text", text: `Temperature: ${data.current.temperature_2m}°F` }] };
  }

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file demonstrates rewindFiles/rewind_files, which restores prior file states and can delete newly created files or overwrite modifications. Although the effect is noted later in the Notes section, the examples and workflow present the operation before any user-facing warning, which weakens disclosure for a destructive action.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/mcp.md (reported line 40)May include surrounding context.

md

mcpServers: {
  "remote-api": {
    type: "sse",  // or "http" for streamable HTTP
    url: "https://api.example.com/mcp/sse",
    headers: { Authorization: `Bearer ${process.env.API_TOKEN}` }
  }
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/mcp.md (reported line 117)May include surrounding context.

md

mcpServers: {
  "remote-api": {
    type: "sse",  // or "http" for streamable HTTP
    url: "https://api.example.com/mcp/sse",
    headers: { Authorization: `Bearer ${process.env.API_TOKEN}` }
  }
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly states that log events can include every prompt, API request, API error, and tool result, and then shows how to export them to an external OTLP collector. Although this is documentation rather than executable code, the lack of a clear warning about sensitive data leaving the local environment can lead users to unintentionally exfiltrate prompts, secrets, customer data, or tool outputs to third-party observability systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation promotes powerful capabilities such as file editing, shell execution, web access, hooks, MCP connections, and permission bypass modes without an adjacent, explicit security warning about destructive actions, credential exposure, or the need for sandboxing and approval controls. In the context of an agent SDK that operates directly on local files and infrastructure, omission of those warnings can lead developers to deploy unsafe defaults or overtrust the agent in production workflows.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The permission modes explicitly include auto-approval and full bypass behavior, enabling autonomous tool use without user confirmation. While suitable for tightly controlled environments, presenting these modes in overview documentation without strong cautions increases the chance that integrators enable unrestricted agent actions in environments that are not actually sandboxed or fully trusted.

Content

Scanner excerpt · references/overview.md (reported line 68)May include surrounding context.

md

| Mode | Behavior | Use Case |
|------|----------|----------|
| `acceptEdits` | Auto-approve file edits and common filesystem commands | Trusted development workflows |
| `dontAsk` | Deny anything not in `allowedTools` | Locked-down headless agents |
| `default` | Require `canUseTool` callback to handle approval | Custom approval workflows |
| `bypassPermissions` | Run every tool without prompting | Sandboxed CI, fully trusted environments |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/agent-loop.md (reported line 33)May include surrounding context.

md

| Option | Effect |
|:---|:---|
| `allowedTools=["Read", "Grep"]` | Read and Grep auto-approved. Unlisted tools continue through the flow |
| `disallowedTools=["Bash"]` | Bash always denied (highest priority, overrides `bypassPermissions`) |

**Locked-down agent mode:**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/hooks.md (reported line 80)May include surrounding context.

md

| Option | Effect |
|:---|:---|
| `allowedTools=["Read", "Grep"]` | Read and Grep auto-approved. Unlisted tools continue through the flow |
| `disallowedTools=["Bash"]` | Bash always denied (highest priority, overrides `bypassPermissions`) |

**Locked-down agent mode:**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/mcp.md (reported line 85)May include surrounding context.

md

| Option | Effect |
|:---|:---|
| `allowedTools=["Read", "Grep"]` | Read and Grep auto-approved. Unlisted tools continue through the flow |
| `disallowedTools=["Bash"]` | Bash always denied (highest priority, overrides `bypassPermissions`) |

**Locked-down agent mode:**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/permissions.md (reported line 19)May include surrounding context.

md

| Option | Effect |
|:---|:---|
| `allowedTools=["Read", "Grep"]` | Read and Grep auto-approved. Unlisted tools continue through the flow |
| `disallowedTools=["Bash"]` | Bash always denied (highest priority, overrides `bypassPermissions`) |

**Locked-down agent mode:**

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/permissions.md (reported line 38)May include surrounding context.

md

| Option | Effect |
|:---|:---|
| `allowedTools=["Read", "Grep"]` | Read and Grep auto-approved. Unlisted tools continue through the flow |
| `disallowedTools=["Bash"]` | Bash always denied (highest priority, overrides `bypassPermissions`) |

**Locked-down agent mode:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown API reference documents allowed_tools and permission modes including dontAsk and bypassPermissions, which can enable safety-critical operations without confirmation. The file provides no warning that these settings may reduce safeguards or auto-approve tool actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quickstart encourages an agent to 'Fix any issues you find' while using allowed_tools=["Read", "Edit", "Glob"] and permission_mode="acceptEdits", which auto-approves code modifications. In a quickstart context, this can normalize unsupervised changes to user code before users understand the review and safety implications, increasing the chance of accidental destructive edits or unsafe code changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation advertises combinations including Bash as 'Fully automated' and documents bypassPermissions as running all allowed tools, without nearby warnings about command execution, file/system impact, or sandboxing. In an agent SDK, presenting these modes casually in a quickstart/reference increases the risk that users enable autonomous shell execution in sensitive environments, which could lead to destructive commands, data exposure, or supply-chain abuse.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 87% confidence

Finding

This content promotes autonomous behavior through auto-approved edits and permission bypass in an SDK intended to operate on code and potentially run tools. Autonomous decision-making is especially sensitive here because the skill context is agent construction, so unsafe defaults or underspecified guardrails can directly translate into unauthorized file changes or broader system actions.

Content

Scanner excerpt · references/quickstart.md (reported line 59)May include surrounding context.

md

- `Read, Edit, Bash, Glob, Grep` — Fully automated

**Permission modes:**
- `acceptEdits` — Auto-approves file edits (trusted workflows)
- `dontAsk` — Denies anything not in allow list
- `default` — Requires `canUseTool` callback
- `bypassPermissions` — Runs all allowed tools

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation states that session histories containing prompts, tool calls, results, and responses are automatically written to disk, but it does not warn that these records may contain secrets, credentials, proprietary code, or personal data. In an agent SDK context, persistent conversation logs are especially sensitive because they can capture both user inputs and tool outputs, making unintended local exposure, backup leakage, or multi-user host access a realistic risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cross-host resume guidance instructs users to move raw session JSONL files between hosts without warning that those files may contain full conversation history, tool outputs, secrets, or regulated data. This increases the chance of insecure transfer, accidental disclosure, or importing sensitive context onto less-trusted systems, which is particularly dangerous for an agent SDK used in production and debugging workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes how skills are invoked, so SQP-1 applies. Saying the model selects skills 'based on context automatically' does not specify what context qualifies, when a skill should not activate, or any exclusion criteria, which could lead to unintended invocation behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/migration-guide.md:74

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/modifying-system-prompts.md:12

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/quickstart.md:67