ClawHub
Back to skill

Security audit

Claude Code

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a static Claude Code documentation helper, but it includes high-risk copy-paste guidance for remote installers and unpinned package execution.

Review before installing. Treat this as an offline documentation helper, not a real Claude Code task runner. Do not copy the curl | bash, irm | iex, npx -y, or git pull examples unless you have verified the source, pinned versions where possible, and understand the local file and account access those commands may get.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
claude-code.py:26
Finding

Quickstart documentation recommends direct execution of mutable remote scripts

Content
View full analysis

Vulnerability Details

File Location: claude-code.py, lines 26–33
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

python
### macOS/Linux (curl):
```bash
curl -fsSL https://claude.ai/install.sh | bash

Windows (PowerShell):

powershell
irm https://claude.ai/install.ps1 | iex
text

### Technical Analysis

The generated quickstart documentation recommends downloading mutable content from remote URLs and immediately passing it to Bash or PowerShell. The downloaded script is not pinned to a version, inspected, authenticated with a publisher signature, or checked against a trusted cryptographic digest before execution.

Although the URLs appear associated with the declared Claude product, domain reputation does not eliminate the underlying risk. A compromise of the remote server, CDN, DNS resolution, TLS trust chain, or publishing account could change the effective payload after this Skill has been reviewed. The pipe-to-interpreter construction also prevents users from meaningfully reviewing the complete payload before it begins executing.

The Python program does not execute these commands automatically. It displays them when users request the quickstart documentation, such as through `claude-code query quickstart` or `claude-code docs quickstart`. Exploitation therefore requires a user or agent to follow the generated instructions.

### Attack Path

1. A user or AI agent invokes the Skill's quickstart documentation command.
2. The Skill presents one of the remote installation commands as an approved installation method.
3. The user or agent executes the displayed command.
4. Bash or PowerShell begins interpreting the response directly as it arrives.
5. If the remote delivery path has been compromised, attacker-controlled code executes with the privileges of the invoking account.
6. The payload can access or modify resources available t
...[truncated 688 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove both pipe-to-interpreter installation commands from the embedded documentation.
  • Direct users to an official installation page or signed package manager rather than instructing them to execute mutable network responses.
  • If script-based installation is unavoidable:
    1. Download a versioned artifact to a local file without executing it.
    2. Pin the expected release version and canonical download URL.
    3. Verify a publisher signature or compare the artifact against a trusted, hardcoded SHA-256 digest distributed through an independent authenticated channel.
    4. Ask the user to inspect the downloaded script.
    5. Execute it only after verification succeeds.
  • Avoid silent flags and automatic execution so that download or validation failures remain visible.
  • Clearly state what files, network access, and permissions the installer requires before users run it.

T08 · Insecure Dependencies

Warning
Location
claude-code.py:514
Finding

MCP example uses automatic execution of an unpinned npm package

Content
View full analysis

Vulnerability Details

File Location: claude-code.py, lines 514–522
Vulnerability Type: Insecure dependency execution
Risk Level: Medium

Vulnerable Code:

python
Configure MCP in `~/.claude/mcp.json`:
```json
{
  "servers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@anthropic-ai/filesystem-mcp"]
    }
  }
}
text

### Technical Analysis

The generated MCP configuration invokes `npx` with `-y`, allowing npm package retrieval and execution without interactive confirmation. No exact package version is specified, and the example provides no lockfile or integrity metadata. Consequently, package contents can change after the Skill has been audited.

This is a supply-chain risk rather than evidence that the named package is currently malicious. A compromised package publisher, registry account, transitive dependency, or unexpectedly changed future release could cause arbitrary package code to run when Claude launches the configured MCP server.

The example is especially sensitive because it describes a filesystem MCP server. A process providing filesystem capabilities may be granted access to local project or user data. The example does not define or explain an explicit allowlist of permitted filesystem roots.

The reference to `~/.claude/mcp.json` does not itself constitute credential access: the reviewed Python code only prints this path and does not read, write, or transmit that file.

### Attack Path

1. A user requests the Skill's MCP documentation.
2. The user copies the suggested configuration into `~/.claude/mcp.json`.
3. Claude processes the MCP configuration and invokes `npx`.
4. `npx -y` resolves the unpinned package from the configured npm registry without requesting confirmation.
5. A compromised or maliciously changed package or dependency executes under the user's account.
6. The executed code accesses files, environment variables, network resour
...[truncated 617 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace runtime npx -y execution with a separately installed and verified dependency.
  • Pin the package to an exact audited version rather than using an implicit latest release.
  • Manage installation through a lockfile containing registry integrity metadata, and retain the lockfile as part of the reviewed deployment.
  • Invoke the verified local binary directly after installation instead of allowing npx to retrieve code when the MCP server starts.
  • Confirm the official package name and publisher through authoritative MCP documentation before recommending it.
  • Configure an explicit allowlist of filesystem roots and deny access to home-directory secrets, credential stores, SSH material, and unrelated repositories.
  • Run the MCP server in a restricted environment with minimal filesystem permissions, limited environment variables, and network access disabled unless required.
  • Remove -y where interactive use remains necessary so users can review package resolution before execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (20)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

claude-code task -d "Refactor database" -p high

With specific model

claude-code task -d "Implement API" -m claude-3-5-sonnet

text

### ℹ️ info - Show Configuration

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This is a second manifestation of the same description-behavior mismatch: the skill is presented as a full Claude Code/OpenClaw integration but apparently does not directly perform those operations. Such overclaiming can mislead automation into delegating authority, create false operator assurance, and mask where real execution or data handling would occur.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This is a second manifestation of the same description-behavior mismatch: the skill is presented as a full Claude Code/OpenClaw integration but apparently does not directly perform those operations. Such overclaiming can mislead automation into delegating authority, create false operator assurance, and mask where real execution or data handling would occur.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

bash
# Create a coding subagent for a complex task
claude-code task --description "Fix the login bug" --priority high
claude-code task --description "Refactor the database layer" --model claude-3-5-sonnet

List Available Commands

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

bash
claude-code task --description "Implement user authentication module"
claude-code task --description "Refactor database queries" --priority high
claude-code task --description "Write unit tests for the API" --model claude-3-5-sonnet

docs

External Script Fetching

High
Category
Supply Chain
Confidence
93% confidence
Finding

The embedded quickstart documentation recommends piping a remote script directly into bash, which is a dangerous supply-chain pattern. In the context of an agent skill that provides coding guidance, users may copy-paste this command, leading to arbitrary code execution if the remote endpoint or delivery path is compromised.

Content

Scanner excerpt · claude-code.py (reported line 28)May include surrounding context.

python
### macOS/Linux (curl):
```bash
curl -fsSL https://claude.ai/install.sh | bash
```

### Windows (PowerShell):

Chaining Abuse

High
Category
Tool Misuse
Confidence
91% confidence
Finding

The | bash construct chains untrusted network content directly into a shell interpreter, removing any review checkpoint before execution. Although it is presented as documentation rather than executable code in the skill, this skill's purpose is to guide user actions, so unsafe command examples materially increase the risk of user-driven compromise.

Content

Scanner excerpt · claude-code.py (reported line 28)May include surrounding context.

python
### macOS/Linux (curl):
```bash
curl -fsSL https://claude.ai/install.sh | bash
```

### Windows (PowerShell):

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · claude-code.py (reported line 192)May include surrounding context.

python
### Configuration Files
- `~/.claude/` - Main config directory
- `~/.claude/settings.json` - User settings
- `CLAUDE.md` - Project-specific instructions

## Common Settings

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · claude-code.py (reported line 252)May include surrounding context.

python
### ⚠️ "Memory issues"
**Solutions:**
- Clear conversation history
- Reduce batch sizes
- Restart Claude Code session

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · claude-code.py (reported line 280)May include surrounding context.

python
### Token Limits
- Break large tasks into smaller steps
- Use summary contexts
- Clear history periodically

## Getting Help

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · claude-code.py (reported line 338)May include surrounding context.

python
### With Model Selection
```bash
/subagent --name complex-analysis --model claude-3-5-sonnet --description "Deep code analysis"
```

## Best Practices

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · claude-code.py (reported line 514)May include surrounding context.

python
## Configuration

Configure MCP in `~/.claude/mcp.json`:
```json
{
  "servers": {

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

Manual Install

bash
# Create skill directory
mkdir -p ~/.openclaw/skills/claude-code

# Copy files

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill advertises shell-adjacent/code-execution workflows and integration with subagents, but it declares no explicit tool scope such as allowed-tools or permissions. In an agent ecosystem, missing scope boundaries can cause the runtime or invoking agent to grant broader execution capability than the skill actually needs, increasing the chance of unintended command execution or unsafe delegation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation guidance is broad enough to match generic coding-assistance requests, which can cause over-invocation of this skill outside its narrow intended purpose. In agent systems, broad routing language increases the chance that unrelated or sensitive tasks are funneled into a skill with unclear permissions and inaccurate capability claims.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says this skill can query Claude Code documentation from https://code.claude.com/docs, which implies access to current upstream docs. In the implementation, documentation is entirely embedded in a local DOCUMENTATION dictionary and all queries are resolved against that static cache, with no network retrieval or synchronization.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · claude-code.py (reported line 99)May include surrounding context.

python
- Maintain coding standards

### Testing
- Always write tests for AI-generated code
- Test edge cases
- Verify boundary conditions

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The inline comment and command help describe the task subcommand as a subagent task creation capability. However, the implementation only formats and prints a message saying the task will be executed elsewhere, without invoking any subagent system or persisting task state.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

This is a manifest file, so vague-trigger checks apply. The description value is just a generic placeholder symbol with no specific activation scope, constraints, or negative examples, making it unclear when the skill should be invoked and increasing the risk of unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file includes a workflow step that runs openclaw exec "git pull origin main", which changes the user's working copy and can overwrite local state via merge or fast-forward updates. The surrounding documentation presents it as a recommended workflow step but does not warn users that it modifies their repository or that they should ensure a clean working tree first.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.