Cca Domain3

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This is a coherent Claude Code configuration training skill, but it requests broad shell and delegation powers while guiding changes to project agent configuration.

Install only if you are comfortable with a training skill that can edit project Claude Code configuration and has shell/delegation authority. Review any generated CLAUDE.md, .claude/rules, .claude/skills, and .mcp.json changes before committing them, and avoid using it in repositories containing untrusted prompt content or sensitive local configuration unless you can constrain tool use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive execution and delegation permissions
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: Read, Write, Edit, Bash, Grep, Glob, Agent

Technical Analysis

The skill permits unrestricted use of Bash and Agent, although its documented purpose is to teach Claude Code configuration and help users create project-level configuration files. These high-impact capabilities are broader than necessary for that purpose.

Bash can execute arbitrary commands with the operating-system privileges of the host agent process. Agent can delegate work to sub-agents, potentially expanding the number and complexity of actions performed. No command allowlist, directory boundary, confirmation requirement, or equivalent restriction is defined in the skill.

The permission declaration does not itself execute a command, and the reviewed file contains no explicitly malicious shell payload. Nevertheless, exposing unnecessary execution and delegation capabilities increases the consequences of adversarial user input, prompt injection from project content, or unsafe generated instructions.

Attack Path

1. A user invokes the skill in a repository containing adversarial content, or supplies an adversarial request during the practical exercise.
2. The content influences the skill to treat an unrelated operation as part of the requested workflow.
3. Because Bash and Agent are permitted, the agent can execute arbitrary shell commands or delegate unsafe actions without first encountering a tool-level least-privilege boundary.
4. Those actions run with the permissions available to the host agent and may access or alter resources beyond the files required by the exercise.

This is an exposure path rather than evidence that the reviewed skill already contains or executes a malicious payload.

Impact Assessment

Successful exploitation could provide access up to the ...[truncated 547 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove unnecessary high-impact tools from the frontmatter. For the documented workflow, prefer a restricted declaration such as:

yaml

allowed-tools: Read, Write, Edit, Grep, Glob

2. If shell execution is essential for a specific exercise, place it in a separate, explicitly invoked skill with:

   • A narrow command allowlist.
   • Project-root path confinement.
   • User confirmation before execution.
   • Restrictions against network access and access to credentials or user-level configuration.
   • Validation and safe quoting of all command arguments.

3. Remove Agent unless isolated delegation is essential. If retained, constrain delegated tasks to read-only analysis and require explicit approval before a sub-agent performs modifications.

4. Separate explanatory tutoring from practical project modification so users can invoke the read-only portion without granting write or execution privileges.

5. Document the exact files the practical exercise may create or modify, and verify resolved paths remain within the intended project root before writing.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

- Skills 在 `.claude/skills/` 中，`SKILL.md` 文件支持 frontmatter：

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

**核心知识：**
- 项目级命令 `.claude/commands/` — 版本控制，团队共享
- 用户级命令 `~/.claude/commands/` — 个人使用
- Skills 在 `.claude/skills/` 中，`SKILL.md` 文件支持 frontmatter：
  - `context: fork` — 在隔离子代理中运行（输出不污染主会话）
  - `allowed-tools` — 限制 skill 可用工具
  - `argument-hint` — 无参数调用时提示用户