Claude Code Master

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:22 AM UTC
• Version: 1.0.1

Overview

This is mostly a Claude Code workflow guide, but it includes persistent hook, external CLI, and unpinned installer examples that could expose code, session output, or credentials if followed as written.

Review before installing. Do not enable the documented global hooks unless you are comfortable with future Claude Code session output being saved and signaled to OpenClaw; prefer project-scoped hooks, private 0700 storage, no full-output capture, short-lived scoped tokens, and clear uninstall steps. Avoid the mandatory Gemini review style for private code unless you explicitly approve sending each file to that provider. Pin and verify any SuperClaude or MCP packages before running installer or npx commands.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

• Location: references/hooks-mechanism.md:139

Finding

Persistent Global Hooks Capture Complete Claude Code Session Output

Content

View full analysis

/dev/null | wc -l || echo "0") cat > "$LATEST_FILE" < ~/.claude/hooks/stop-hook.sh << 'EOF' #!/bin/bash # Insert the hook script here EOF cat > ~/.claude/hooks/session-end-hook.sh << 'EOF' #!/bin/bash # Insert the hook script here EOF chmod +x ~/.claude/hooks/*.sh ``` ```json { "hooks": { "enabled": true, "stop": "~/.claude/hooks/stop-hook.sh", "sessionEnd": "~/.claude/hooks/session-end-hook.sh" } } ``` ### Technical Analysis The documented workflow installs executable hooks in the user's global `~/.claude` configuration and registers them for future Stop and SessionEnd events. These hooks remain active after t ...[truncated 1751 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/hooks-mechanism.md:52

Finding

Complete Session Output Is Written to a Predictable World-Writable Temporary Path

Content

View full analysis

"$LATEST_FILE" <

Remediation

View remediation

other

Error

• Location: references/output-styles-examples.md:1

Finding

Mandatory Gemini CLI Review Can Disclose Confidential Source Code to an External Service

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: references/superclaude-guide.md:18

Finding

Unpinned Remote Installer and Runtime-Fetched MCP Packages Create Supply-Chain Execution Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/hooks-mechanism.md:282

Finding

Bearer Token Is Persisted in Plaintext Shell Startup Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest presents the skill as guidance and best practices, but the content also instructs project setup, local installation, and filesystem-changing workflows. This mismatch is dangerous because users or orchestration systems may grant it in low-risk advisory situations while it still drives privileged local actions.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/hooks-mechanism.md (reported line 267)May include surrounding context.

bash

# 下载或创建 hook 脚本
cat > ~/.claude/hooks/stop-hook.sh << 'EOF'
#!/bin/bash
# ... (粘贴上面的脚本)
EOF

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/hooks-mechanism.md (reported line 272)May include surrounding context.

bash

# 下载或创建 hook 脚本
cat > ~/.claude/hooks/stop-hook.sh << 'EOF'
#!/bin/bash
# ... (粘贴上面的脚本)
EOF

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/hooks-mechanism.md (reported line 291)May include surrounding context.

4.4 Claude Code 配置

文件位置： ~/.claude/config.json

json

{

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The chmod 777 instruction is an unsafe permission-setting example that abuses a powerful file-system parameter and can directly undermine confidentiality and integrity. In this skill context, users may copy-paste the command, making the guidance materially dangerous rather than merely theoretical.

Content

Scanner excerpt · references/hooks-mechanism.md (reported line 472)May include surrounding context.

手动创建

mkdir -p /tmp/claude-code-hooks chmod 777 /tmp/claude-code-hooks

text

## 八、最佳实践

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/quick-reference.md (reported line 15)May include surrounding context.

md

claude --cwd /path/to/project

# 使用特定模型
claude --model claude-3-opus-20240229

# 非交互模式
claude -p "task description" --output-format json

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/quick-reference.md (reported line 18)May include surrounding context.

claude --model claude-3-opus-20240229

非交互模式

claude -p "task description" --output-format json

text

### 1.2 Output Styles

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill's natural-language instructions and usage guidance are presented in Chinese only, and there is no indication that the user can choose another language. That can violate language/locale policy where skills should not force a language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill declares very broad activation conditions such as improving Claude Code efficiency, saving tokens, workflow setup, and best practices, which are common requests that can appear in many unrelated conversations. This can cause the skill to auto-activate too often, injecting large amounts of guidance and workflow instructions into contexts where the user did not explicitly request this specific skill, increasing the risk of prompt/context interference and unintended behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill includes operational guidance that can create or modify local files and directories, but it does not declare an explicit tool scope or permissions boundary. That increases the chance an agent auto-invokes filesystem-capable actions in contexts where the user only expected advisory content, weakening least-privilege guarantees.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation text is extremely broad and says the skill must be used for many generic Claude Code help scenarios. Overbroad triggering increases the chance this skill is selected in unrelated contexts and exposes users to setup, install, or networking instructions they did not specifically request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill is written entirely in Chinese and presents itself as a mandatory guide for use, but it does not state that language is optional or that users may choose another locale. Under the policy, imposing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill explicitly includes a curl POST with a bearer token to a local HTTP endpoint, representing external transmission of task completion data and credentials to another service. Although localhost reduces exposure, the pattern is still sensitive because local services can be spoofed, misconfigured, or log secrets and task output unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

Wake Event 调用：

bash

curl -X POST "http://127.0.0.1:18789/api/cron/wake" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"text": "Claude Code 任务完成，读取 latest.json", "mode": "now"}'

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill recommends installing and running an MCP server via npx without pinning a specific version. This creates a supply-chain risk because future package updates or a compromised upstream release could execute unexpected code on the user's machine when the command is run.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command executes an unpinned MCP server package through npx, which fetches and runs the latest available version by default. That exposes users to upstream tampering, malicious updates, or breaking behavior with code execution impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The repeated unpinned npx invocation for the puppeteer MCP server carries the same supply-chain execution risk as other dynamic package installs. Because MCP servers often have broad local access, compromise of the package could lead to significant host or data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The file title and the surrounding instructional content are written entirely in Chinese, and the document does not indicate that language selection is optional or region-specific. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is in scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document includes a crawler example that explicitly mentions anti-detection tactics such as proxy rotation, User-Agent rotation, handling JavaScript-rendered pages, and dealing with anti-scraping detection. In a skill whose stated purpose is Claude Code optimization and workflow best practices, this materially expands the skill into dual-use offensive scraping guidance without clear scope restriction or safety framing, making misuse easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented hooks persist full Claude output, working directory, session ID, and metadata to /tmp without warning that the output may contain user secrets, proprietary code, or sensitive prompts. /tmp is a shared and commonly inspected location on many systems, so this pattern can expose data to other local users or processes.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The hook design stores the complete Claude output persistently and frames it as a normal part of the workflow. Full model output can include secrets, code, internal paths, credentials pasted by users, or other sensitive business data, making indiscriminate capture and later sharing risky.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a guidance skill for Claude Code optimization, workflow setup, and best practices. This file goes beyond explaining Claude Code itself by prescribing an authenticated integration with a separate local service using Authorization: Bearer $TOKEN, which introduces operational credential handling not obviously required for a Claude Code usage guide.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/hooks-mechanism.md (reported line 126)May include surrounding context.

md

EOF

# 发送 wake event（失败也不影响）
curl -X POST "http://127.0.0.1:18789/api/cron/wake" \
  -H "Authorization: Bearer ${OPENCLAW_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{\"text\": \"Claude Code 任务已停止，读取 latest.json\", \"mode\": \"now\"}" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/hooks-mechanism.md (reported line 180)May include surrounding context.

md

EOF

# 发送 wake event（失败也不影响）
curl -X POST "http://127.0.0.1:18789/api/cron/wake" \
  -H "Authorization: Bearer ${OPENCLAW_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{\"text\": \"Claude Code 任务已停止，读取 latest.json\", \"mode\": \"now\"}" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/hooks-mechanism.md (reported line 231)May include surrounding context.

md

local mode="${2:-now}"

  if [[ -n "$TOKEN" ]]; then
    curl -s -X POST "$WAKE_API" \
      -H "Authorization: Bearer $TOKEN" \
      -H "Content-Type: application/json" \
      -d "{\"text\": \"$text\", \"mode\": \"$mode\"}" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/hooks-mechanism.md (reported line 259)May include surrounding context.

4.1 创建 Hook 目录

bash

mkdir -p ~/.claude/hooks
chmod +x ~/.claude/hooks

Static analysis

No suspicious patterns detected.