ClawHub
Back to skill

Security audit

Claude Code Connector

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed bridge for sending a prompt to Claude Code, but users should understand that delegated content may leave the current agent boundary.

Install only if you intentionally want to delegate prompts to Claude Code through the local ACP bridge. Review and trust the local bridge script separately, and avoid sending secrets, private files, or sensitive project context unless you are comfortable with that data being handled by the Claude Code environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

name: call-claude-code description: | 通过 ACP 桥接调用 Claude Code。

触发词： "调用 Claude"、"让 Claude 处理"、"claude code"

使用方式：

text
调用 Claude Code 分析这个文件

Call Claude Code via ACP

工具定义

json
{
  "name": "call_claude_code",
  "description": "Call Claude Code via ACP bridge",
  "inputSchema": {
    "type": "object",
    "properties": {
      "prompt": {
        "type": "string",
        "description": "The prompt to send to Claude Code"
      }
    },
    "required": ["prompt"]
  }
}

执行逻辑

bash
/Users/

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill does not clearly warn users that prompts will be transmitted to Claude Code through an external ACP bridge. This creates a real risk of users unknowingly sending sensitive code, file contents, or conversation context outside the current agent boundary, which is a meaningful confidentiality and trust issue.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad natural-language expressions that can easily appear in ordinary conversation, increasing the chance that the skill is invoked unintentionally. Because the skill forwards user-provided content to an external Claude Code bridge, accidental activation can lead to unintended data disclosure or unreviewed delegation of tasks to another system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The activation and usage guidance are presented in Chinese, including the trigger phrases users are expected to say, but the file does not indicate that this language requirement is optional or region-specific. That can create a locale policy issue because users are implicitly required to use one language without an explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.