ClawHub
Back to skill

Security audit

Claude Code Controller

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Claude Code launcher, but it automatically creates a broad auto-approval configuration that can let Claude run shell commands and edit files without per-action confirmation.

Review the generated .claude/settings.json before using this skill. Prefer read-only or explicit-approval settings for code review and untrusted repositories, pin or preinstall npm/npx tools you trust, and avoid placing real API keys or database credentials directly in examples, committed config files, shell history, or logs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/config-reference.md:34
Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content
View full analysis
/dev/null; then echo -e "${RED}Error: Claude Code is not installed${NC}" echo "Please run: npm install -g @anthropic-ai/claude-code" exit 1 fi ``` ### Technical Analysis ...[truncated 2471 chars]
Remediation
View remediation
" ] } ``` 2. Install dependencies through a committed lockfile and use deterministic installation commands such as `npm ci`. 3. Avoid `npx -y` for security-sensitive tools. Require explicit installation and user confirmation before first execution. 4. Validate package provenance, publisher identity, signatures or attestations, and registry integrity before installation. 5. Use npm integrity hashes or an approved internal package mirror where feasible. 6. Run MCP servers in a sandbox or container with narrowly scoped filesystem, environment, and network access. 7. Do not provide database credentials directly to an automatically downloaded executable. Use a restricted database account, secret manager, and short-lived credentials. 8. Document a reviewed upgrade process instead of implicitly accepting the latest package release. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/launch-claudecode.sh:32
Finding

Launcher Creates an Overly Permissive Automatic-Approval Configuration

Content
View full analysis
"$config_file" << EOF { "model": "$DEFAULT_MODEL", "allowedTools": ["bash", "edit", "write", "read"], "maxTurns": 50, "permissionMode": "auto" } EOF fi } ``` The function is applied before entering and launching Claude in the selected project at `scripts/launch-claudecode.sh:65-69`: ```bash check_dependencies check_project_config "$project_dir" # Enter the project directory cd "$project_dir" ``` Equivalent permissive defaults are also recommended in: - `SKILL.md:69-77` - `references/config-reference.md:23-29` - `references/workflows.md:106-113` ### Technical Analysis The generated policy violates least-privilege principles by enabling `bash`, `edit`, `write`, and `read` for all task types while setting `permissionMode` to `auto`. The Skill advertises activities ranging from read-only review to active implementation, but the launcher does not choose permissions according to the requested task. Shell access is materially broader than project-file editing because commands can interact with any resource available to the invoking user unless the underlying runtime provides an additional effective sandbox. Automatic appr ...[truncated 2448 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (29)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

描述强调这是一个用于“控制和管理”Claude Code 的较完整技能，并特别提到通过 ACP 运行时在隔离会话中执行任务、或在主会话中管理配置和项目上下文。但给定代码并没有实现 ACP、隔离会话、会话管理、上下文管理或具体的代码审查/重构逻辑；它只是一个本地启动器脚本，用于校验依赖、检查 API key、在缺少配置时生成默认 .claude/settings.json，并调用 claude CLI 进入交互模式或执行传入任务。因此其实际能力明显比声明更窄，且关键机制（ACP/隔离会话）完全缺失，构成描述与行为不符。

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

  • POST /users - 创建用户
    • GET /users/:id - 获取用户
    • PUT /users/:id - 更新用户
    • DELETE /users/:id - 删除用户 开始实现...
text

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

bash
# 查看 Claude Code 日志
cat ~/.claude/logs/latest.log

# 调试模式运行
claude --debug

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
## 配置文件位置

- **全局配置**: `~/.claude/config.json`
- **项目配置**: `<project>/.claude/settings.json`
- **日志目录**: `~/.claude/logs/`
- **工具目录**: `~/.claude/tools/`

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/config-reference.md (reported line 14)May include surrounding context.

md
## 配置文件位置

- **全局配置**: `~/.claude/config.json`
- **项目配置**: `<project>/.claude/settings.json`
- **日志目录**: `~/.claude/logs/`
- **工具目录**: `~/.claude/tools/`

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/config-reference.md (reported line 155)May include surrounding context.

md
## 配置文件位置

- **全局配置**: `~/.claude/config.json`
- **项目配置**: `<project>/.claude/settings.json`
- **日志目录**: `~/.claude/logs/`
- **工具目录**: `~/.claude/tools/`

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/config-reference.md (reported line 158)May include surrounding context.

md
## 配置文件位置

- **全局配置**: `~/.claude/config.json`
- **项目配置**: `<project>/.claude/settings.json`
- **日志目录**: `~/.claude/logs/`
- **工具目录**: `~/.claude/tools/`

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/config-reference.md (reported line 15)May include surrounding context.

md
## 配置文件位置

- **全局配置**: `~/.claude/config.json`
- **项目配置**: `<project>/.claude/settings.json`
- **日志目录**: `~/.claude/logs/`
- **工具目录**: `~/.claude/tools/`

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/launch-claudecode.sh (reported line 35)May include surrounding context.

sh
## 配置文件位置

- **全局配置**: `~/.claude/config.json`
- **项目配置**: `<project>/.claude/settings.json`
- **日志目录**: `~/.claude/logs/`
- **工具目录**: `~/.claude/tools/`

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/config-reference.md (reported line 67)May include surrounding context.

bash
# 命令行指定
claude --model claude-opus-4-5-20250929

# 配置文件指定
{

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · references/config-reference.md (reported line 146)May include surrounding context.

问题: 模型不可用

bash
# 检查模型名称是否正确
claude --model claude-sonnet-4-5-20250929 --version

# 查看可用模型
claude --list-models

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/config-reference.md (reported line 165)May include surrounding context.

bash
# 查看最新日志
tail -f ~/.claude/logs/latest.log

# 查看错误日志
grep -i error ~/.claude/logs/*.log

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/config-reference.md (reported line 168)May include surrounding context.

tail -f ~/.claude/logs/latest.log

查看错误日志

grep -i error ~/.claude/logs/*.log

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file presents all operational instructions, descriptions, and invocation guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file’s natural-language instructions and examples are presented exclusively in Chinese, including the description and all usage guidance. Under the policy, forcing a specific language without user opt-in or a documented justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md
- [Claude Code 官方文档](https://docs.anthropic.com/claude-code)
- [OpenClaw ACP 文档](https://docs.openclaw.ai)
- [技能开发指南](/usr/lib/node_modules/openclaw/skills/skill-creator/SKILL.md)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The documentation shows API key handling and a DATABASE_URL example containing inline credentials, plus shell commands that encourage direct secret export. In a config reference for an agent tool, this can normalize insecure secret handling and increase the chance users paste real secrets into shell history, config files, or logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The customInstructions example says 使用英文注释和提交信息 ('use English comments and commit messages'), which is a natural-language locale policy constraint. SQP-3 applies because it imposes a specific language choice without offering the user a choice or documenting a justified locale-specific requirement.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/config-reference.md (reported line 155)May include surrounding context.

问题: 权限被拒绝

bash
# 检查配置文件权限
ls -la ~/.claude/config.json

# 修复权限
chmod 600 ~/.claude/config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/config-reference.md (reported line 158)May include surrounding context.

ls -la ~/.claude/config.json

修复权限

chmod 600 ~/.claude/config.json

text

### 日志查看

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger '用户需要实现新功能' is very broad and does not define clear boundaries for when this workflow should be invoked versus other workflows. The section provides examples, but it does not give exclusions or a constrained trigger list, increasing the chance of unintended activation for general coding help.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger '发现 bug 或异常行为' is generic and could match a wide range of troubleshooting, debugging, or even vague user complaints. The file does not clarify what evidence or context is required before this workflow should activate, nor does it provide exclusion conditions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The phrase '代码需要改进可维护性或性能' is subjective and lacks concrete activation boundaries. Without explicit constraints or exclusions, ordinary requests about performance tuning, cleanup, or code explanation may unintentionally map to this workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger '需要审查代码质量' is broad and does not define what form of input or review context is required, such as a PR, diff, or specific module. This ambiguity can cause overlap with debugging, refactoring, or ad hoc code advice requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger '需要评估技术方案或库' can apply to many ordinary development conversations and does not clearly distinguish research from implementation planning or architecture design. The section lacks negative examples or a closed set of trigger phrases to reduce accidental invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.