ClawHub
Back to skill

Security audit

claude-code-delegate

Security checks for vulnerabilities and agentic risk

Overview

This skill openly delegates coding work to another local AI tool, but it recommends broad permission bypass and automatic execution, so it needs careful review before use.

Install only if you understand that this skill may run another local AI coding CLI that can read and modify files. Use it only inside an isolated project directory, enable a real write-guard or sandbox first, keep it away from home directories, system configuration, and repositories containing secrets, and confirm the exact task and target path before delegation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill defines automatic delegation triggers so broadly that ordinary development conversation can cause execution of external coding commands without a strong, task-specific opt-in. In this skill's context, that is dangerous because delegated commands are later run with powerful exec access and recommended full write permissions, increasing the chance of unintended code execution or filesystem modification from ambiguous user prompts.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly recommends running the delegated CLI with '--permission-mode bypassPermissions', which grants broad filesystem write capability, while presenting write protection as only a warning and not an enforced prerequisite. In the context of an agent skill with exec, write, and read tools, this materially increases the risk of destructive file changes, secret exposure, repository tampering, or persistence if the delegated tool behaves unexpectedly or is prompted adversarially.

Static analysis

No suspicious patterns detected.