Claude Code Connector

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill is a disclosed Claude Code bridge, but its core action depends on an undeclared local shell script outside the submitted package.

Treat this as a review-before-use skill. The idea of calling Claude Code is coherent, but the submitted package does not include the bridge script it tells the agent to run. Inspect /Users/mac/.openclaw/workspace/scripts/acp-bridge-claude.sh, confirm it is yours and safe, and avoid sending private files or secrets unless you understand how the bridge forwards data.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the skill is invoked, the actual action depends on an unreviewed local script, which could do more than simply bridge to Claude Code.

Why it was flagged

The submitted skill contains no install spec or code files, but its described execution depends on a local helper script outside the package. That creates a provenance gap for the core behavior.

Skill content

## 执行逻辑

```bash
/Users/mac/.openclaw/workspace/scripts/acp-bridge-claude.sh
```

Recommendation

Before using the skill, inspect the referenced script, confirm where it came from, and make sure it only performs the intended ACP bridge action.

Low

#ASI05: Unexpected Code Execution

What this means

Using the skill may execute local code on your machine.

Why it was flagged

The skill's runtime behavior involves executing a local shell script. Local command execution is expected for a bridge, but it is still important because shell scripts can access or modify local files under the user's permissions.

Skill content

/Users/mac/.openclaw/workspace/scripts/acp-bridge-claude.sh

Recommendation

Run it only after verifying the shell script contents and avoid enabling it in environments where an untrusted file could exist at that path.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Prompts, and any file contents the user includes or asks to analyze, may be sent to Claude Code through the bridge.

Why it was flagged

The skill is explicitly designed to pass user prompts to another agent/tool through an ACP bridge. This is purpose-aligned, but it creates a data boundary users should understand.

Skill content

"description": "Call Claude Code via ACP bridge"

Recommendation

Only send information that is appropriate for Claude Code to process, and verify the bridge script's handling of prompts and outputs.