ClawHub
Back to skill

Security audit

Cc Helper

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Claude Code setup guide, but it gives users risky install and credential-handling instructions that need review before use.

Install only if you are comfortable reviewing shell install commands yourself. Prefer official installer documentation, avoid piping remote scripts directly into bash, keep API keys in environment variables or a secret store rather than project files, and back up or use supported logout/reset flows before changing Claude credential files.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/install-guide.md:59
Finding

Unverified Remote Installation Scripts Are Executed Directly

Content
View full analysis

Vulnerability Details

File Location: references/install-guide.md, lines 59 and 113
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable code:

bash
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
bash
# Install nvm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash

Technical Analysis

These commands retrieve shell scripts over the network and execute them immediately without first saving them for inspection or verifying a cryptographic signature or checksum.

The Homebrew command retrieves from the mutable HEAD reference, so the effective payload can change after the Skill has been reviewed. The nvm command pins a release tag, which provides better version stability, but it still does not verify the downloaded content against an independently published digest or signature. A tag may also be moved if the upstream repository is compromised.

The URLs refer to recognizable upstream GitHub repositories rather than an obvious paste service. Nevertheless, direct remote-to-shell execution creates a supply-chain execution channel. Installing Node.js or Homebrew may support the Skill's setup purpose, but immediate execution of unverified remote content exceeds the minimum privilege and trust required for a documentation-based configuration assistant.

Attack Path

  1. An attacker compromises an upstream repository, maintainer account, referenced branch or tag, or another part of the content-delivery path.
  2. The attacker changes the remotely hosted installation script or causes malicious content to be returned.
  3. A user follows the Skill's installation instructions.
  4. curl streams the attacker-controlled content directly to Bash.
  5. The payload executes without an intermediate inspection or integrity-validation step.
  6. The payload can perform any operat ...[truncated 613 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer official package-manager instructions or link users to the official installation documentation instead of executing remote scripts directly.
  2. If scripted installation is necessary, pin the download to an immutable commit digest rather than HEAD or a movable tag.
  3. Download the script to a local file before execution:
    bash
    curl -fL -o install.sh "https://example.invalid/path/pinned-install.sh"
  4. Verify the file against an independently published SHA-256 digest or cryptographic signature.
  5. Instruct the user to inspect the downloaded script before running it.
  6. Execute only after explicit user confirmation and document whether the installer may request administrative privileges.
  7. Provide safer alternatives such as the official Node.js installer or distribution package manager.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:195
Finding

Plaintext API Credentials May Be Accidentally Committed to Source Control

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 195–215
Vulnerability Type: Plaintext secret storage and incorrect Git-ignore guidance
Risk Level: High

Vulnerable configuration:

json
{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.deepseek.com/anthropic",
    "ANTHROPIC_AUTH_TOKEN": "Your-API-Key",
    "ANTHROPIC_MODEL": "deepseek-v4-pro[1m]",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "deepseek-v4-pro[1m]",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "deepseek-v4-pro[1m]",
    "ANTHROPIC_DEFAULT_HAIKU_MODEL": "deepseek-v4-flash",
    "CLAUDE_CODE_SUBAGENT_MODEL": "deepseek-v4-flash",
    "CLAUDE_CODE_EFFORT_LEVEL": "max"
  }
}

Related unsafe guidance:

text
settings.local.json is not committed to Git. If settings.json is used, make sure .gitignore contains !.claude/settings.local.json or that the entire .claude/ directory is not committed.

Technical Analysis

The persistent configuration method places a provider API credential directly in a plaintext JSON file under the project directory. Any process or user with access to the project files may be able to read the credential.

The recommended .gitignore negation rule, !.claude/settings.local.json, means that the file is explicitly excluded from an existing ignore pattern. It does not ensure that the file remains untracked. This contradicts the accompanying assurance and can make it easier to stage and commit the credential-bearing file.

Environment variables shown elsewhere in the Skill also expose secrets to the current process environment, but the persistent project file creates a greater cross-session and source-control exposure risk.

Attack Path

  1. A user selects persistent configuration and substitutes a real API key into .claude/settings.local.json.
  2. The user relies on the Skill's assurance that the local settings file will not enter Git.
  3. The user applies or retains the suggested negation ...[truncated 907 chars]
Remediation
View remediation

Remediation Suggestions

  1. Prefer session-scoped environment variables, an operating-system credential manager, or another secret store supported by Claude Code.
  2. Do not embed real API keys in project configuration files.
  3. If a local secret file is unavoidable, add a positive ignore rule:
    gitignore
    .claude/settings.local.json
    or:
    gitignore
    .claude/
  4. Remove the !.claude/settings.local.json recommendation.
  5. Verify ignore behavior before storing a key:
    bash
    git check-ignore -v .claude/settings.local.json
  6. Recommend restrictive filesystem permissions where supported.
  7. Add secret-scanning hooks or CI checks to reject committed provider keys.
  8. Tell users to revoke and rotate any credential that is accidentally staged, committed, logged, or shared.

T09 · Insecure Skill Coding Practices

Warning
Location
references/troubleshooting.md:116
Finding

Troubleshooting Command Irreversibly Deletes Saved Authentication Credentials

Content
View full analysis

Vulnerability Details

File Location: references/troubleshooting.md, line 116
Vulnerability Type: Unsafe destructive credential-file operation
Risk Level: Medium

Vulnerable code:

bash
# Clear saved Anthropic login credentials
rm -rf ~/.claude/credentials.json   # Clear login token

Technical Analysis

Removing stale Anthropic authentication state may be relevant when troubleshooting provider-selection conflicts. However, the command uses rm -rf against a credential-related path without requiring confirmation or creating a backup.

The recursive option is unnecessary when the target is expected to be a single file, while the force option suppresses errors and confirmation. The instruction also does not first verify the cause of the authentication conflict or recommend Claude Code's supported logout mechanism.

This behavior does not exfiltrate credentials or obtain additional privileges. Its security concern is destructive modification of authentication state beyond what is minimally necessary for diagnosis.

Attack Path

  1. A user experiences a provider configuration or authentication-precedence issue.
  2. The user follows the troubleshooting instruction without backing up the existing credential file.
  3. The command permanently deletes the saved Anthropic login state.
  4. Existing authenticated workflows stop working until the user logs in again.
  5. If the deleted credential cannot be readily restored, the user may experience extended access disruption.

Impact Assessment

The command can cause loss of saved authentication state and denial of access to existing Claude Code sessions. It does not grant an attacker new system privileges, and its direct scope is limited to the invoking user's Claude credential file.

The use of ~ keeps the documented command within the current user's home directory, but the deletion is still irreversible under the provided procedure.

Remediation
View remediation

Remediation Suggestions

  1. Prefer the official Claude Code logout or credential-reset command, if available.
  2. Confirm that stored Anthropic authentication is actually causing the conflict before modifying credential files.
  3. Require explicit user confirmation before changing authentication state.
  4. Preserve the file by moving it to a backup instead of deleting it:
    bash
    mv ~/.claude/credentials.json ~/.claude/credentials.json.backup
  5. If deletion remains necessary, use a non-recursive command only after checking that the target is a regular file.
  6. Document how to restore the backup and how to reauthenticate.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (39)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install-guide.md (reported line 100)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt update && sudo apt install git -y

# Fedora
sudo dnf install git -y

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Piping curl output directly into bash is a classic high-risk pattern because it combines remote retrieval and immediate shell execution in one step. In an onboarding skill, this is more dangerous because it lowers user scrutiny and can rapidly propagate a compromised upstream installer to many developer environments.

Content

Scanner excerpt · references/install-guide.md (reported line 113)May include surrounding context.

bash
# 安装 nvm
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash

# 重新加载 shell
source ~/.bashrc   # 或 source ~/.zshrc

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 98)May include surrounding context.

原因: settings.json 放在了 Windows 路径而非 WSL2 路径。

解决: WSL2 内的配置路径是 Linux 的 ~/.claude/settings.json（即 /home/用户名/.claude/settings.json），不是 Windows 的 C:\Users\...。

验证:

bash

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 98)May include surrounding context.

原因: settings.json 放在了 Windows 路径而非 WSL2 路径。

解决: WSL2 内的配置路径是 Linux 的 ~/.claude/settings.json（即 /home/用户名/.claude/settings.json），不是 Windows 的 C:\Users\...。

验证:

bash

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The guide directly references the credentials store path ~/.claude/credentials.json in the context of deleting it. In a copy-paste-oriented setup skill, pointing users to a credential file combined with destructive instructions increases risk of accidental credential removal and makes the credential store a target for unsafe handling.

Content

Scanner excerpt · references/troubleshooting.md (reported line 116)May include surrounding context.

解决:

bash
# 清除已保存的 Anthropic 登录凭证
rm -rf ~/.claude/credentials.json   # 清除登录 Token

或者使用 ANTHROPIC_BASE_URL 指向非 Anthropic 端点——Claude Code 会自动切换为第三方认证方式。

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The documentation identifies a credential file and instructs users to remove it, which constitutes unsafe handling of authentication material. Even though the intent is troubleshooting, this can lead to loss of access state, confusion, or unsafe practices around credential storage and deletion.

Content

Scanner excerpt · references/troubleshooting.md (reported line 116)May include surrounding context.

解决:

bash
# 清除已保存的 Anthropic 登录凭证
rm -rf ~/.claude/credentials.json   # 清除登录 Token

或者使用 ANTHROPIC_BASE_URL 指向非 Anthropic 端点——Claude Code 会自动切换为第三方认证方式。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The guide provides a destructive shell command, rm -rf ~/.claude/credentials.json, that users may execute verbatim. While scoped to one file, use of rm -rf is unnecessarily forceful for a credential file and, in this skill's one-click onboarding/troubleshooting context, increases the chance of accidental misuse or cargo-cult reuse against other paths.

Content

Scanner excerpt · references/troubleshooting.md (reported line 116)May include surrounding context.

解决:

bash
# 清除已保存的 Anthropic 登录凭证
rm -rf ~/.claude/credentials.json   # 清除登录 Token

或者使用 ANTHROPIC_BASE_URL 指向非 Anthropic 端点——Claude Code 会自动切换为第三方认证方式。

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The guide provides a destructive shell command, rm -rf ~/.claude/credentials.json, that users may execute verbatim. While scoped to one file, use of rm -rf is unnecessarily forceful for a credential file and, in this skill's one-click onboarding/troubleshooting context, increases the chance of accidental misuse or cargo-cult reuse against other paths.

Content

Scanner excerpt · references/troubleshooting.md (reported line 116)May include surrounding context.

解决:

bash
# 清除已保存的 Anthropic 登录凭证
rm -rf ~/.claude/credentials.json   # 清除登录 Token

或者使用 ANTHROPIC_BASE_URL 指向非 Anthropic 端点——Claude Code 会自动切换为第三方认证方式。

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README advertises automatic environment detection and configuration writing but does not warn users that the skill may inspect local tooling, read environment-related state, or modify files such as settings. In a setup assistant that may install CLI tools and alter provider credentials/configuration, lack of disclosure and consent can lead to unintended system changes and exposure of sensitive local information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation examples are very broad natural-language requests that can match common user phrasing without clear scope limits. In a skill that can inspect the environment, guide installs, and write configuration, ambiguous triggering increases the chance the agent performs sensitive setup actions when the user intended only to ask a general question.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description explicitly frames the skill as onboarding "for Chinese developers" and the document is written primarily in Chinese, but it does not offer the user a language/locale choice or clearly state that the skill is intentionally region-specific for compliance reasons. This can violate language/locale policy by implicitly forcing a specific language or locale context without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger list includes phrases like "Claude Code 怎么用", "setup claude", and mentions of "Claude Code API", which are broad enough to match many ordinary help or discussion requests rather than this specific setup skill. The section does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill instructs users to store a live API credential in .claude/settings.local.json, a local project file. Even though it warns against Git submission, placing secrets in project-local config materially increases the chance of accidental disclosure through commits, backups, workspace sharing, support bundles, or other tooling that reads project files.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

json
{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.deepseek.com/anthropic",
    "ANTHROPIC_AUTH_TOKEN": "你的API-Key",
    "ANTHROPIC_MODEL": "deepseek-v4-pro[1m]",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "deepseek-v4-pro[1m]",

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest and body describe Phase 4 as generating or writing configuration, including explicitly creating .claude/settings.local.json in the current project directory. This directly conflicts with the statement that the skill 'does not produce local files' and misstates the actual behavior the skill is designed to guide users through.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Line L308 states '本 skill 不产生本地文件。所有操作在对话中完成', yet Phase 4 at L216-L233 documents creating a local JSON file under .claude/. This is an active contradiction in the skill's own documentation about whether local file creation is part of its intended operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The macOS installation guide instructs users to execute a remotely fetched Homebrew installer via curl into bash without any warning, integrity verification, or pinning to a known version. If the upstream source, network path, or referenced script were compromised, users would execute arbitrary code on their machine during setup.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install-guide.md (reported line 100)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt update && sudo apt install git -y

# Fedora
sudo dnf install git -y

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install-guide.md (reported line 106)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt update && sudo apt install git -y

# Fedora
sudo dnf install git -y

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install-guide.md (reported line 127)May include surrounding context.

bash
# Ubuntu/Debian
sudo apt update && sudo apt install git -y

# Fedora
sudo dnf install git -y

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
sudo apt update && sudo apt install git -y

# Fedora
sudo dnf install git -y

# Arch
sudo pacman -S git

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
sudo apt update && sudo apt install git -y

# Fedora
sudo dnf install git -y

# Arch
sudo pacman -S git

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install-guide.md (reported line 103)May include surrounding context.

md
sudo apt update && sudo apt install git -y

# Fedora
sudo dnf install git -y

# Arch
sudo pacman -S git

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Linux instructions pipe the nvm install script directly from GitHub into bash, which executes downloaded code immediately with no review or integrity check. This is especially risky in a developer onboarding skill because users are encouraged to run it verbatim, making supply-chain or MITM compromise highly impactful.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file title and descriptive text are written entirely in Chinese, and the document does not offer an alternative language or indicate that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
| 字段 | 值 |
|---|---|
| **Base URL** | `https://api.deepseek.com/anthropic` |
| **认证方式** | `ANTHROPIC_AUTH_TOKEN` |
| **推荐主模型** | `deepseek-v4-pro[1m]` |
| **推荐轻量模型** | `deepseek-v4-flash` |

Static analysis

No suspicious patterns detected.