Security audit

claude-code-delegate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coding delegator, but it routes broad development work into an external CLI with permission bypass and only optional containment, so users should review it carefully before installing.

Install only if you intentionally want coding tasks delegated to this external CLI. Use an isolated project directory, avoid running it from a home directory or secrets-bearing repository, verify the npm package and version yourself, enable a real write guard or sandbox, and do not use permission bypass unless you understand the filesystem access it grants.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:36
Finding: Mandatory redirection of host Agent behavior to an external CLI
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:52
Finding: External coding assistant is granted bypassed permissions without mandatory containment
Content: View full analysis
No write-protection plug-in was detected. The delegator uses > `--permission-mode bypassPermissions` to grant full filesystem read and > write access. Setting up the write-protection plug-in before execution is > strongly recommended. Only checks 1 and 2 must pass before delegation. Check 3 is a warning; the user may choose to continue without setting it up, but must be informed of the risk. ``` ```bash cd "" && ai-assistant -p "" --output-format text --max-turns 10 --permission-mode bypassPermissions ``` ```markdown | `--permission-mode bypassPermissions` | Automatically accept file edits; write protection required | Recommended | ``` ### Technical Analysis The documented execution mode explicitly bypasses normal permission checks and is stated to grant full filesystem read/write access. The only compensating control, a write-protection plug-in, is optional: users are permitted to continue when it is absent. Changing the current directory with `cd` is not a security boundary. A child process can still use absolute paths, parent-directory traversal, symbolic links, mounted paths, environment variables, or subprocesses to access data outside the project. The assertion elsewhere in the document that the `cd` prefix ensures project-only access is therefore technically incorrect. The configuration violates least privilege because ordinary source-code editing does not require unrestricted access to every file available to the user's operating-system account. ### Attack Path 1. The write-protection plug-in ...[truncated 1051 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:54
Finding: Unpinned third-party CLI is installed globally from the npm registry
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:75
Finding: Task descriptions and project paths are interpolated into a shell command
Content: View full analysis
" && ai-assistant -p "" --output-format text --max-turns 10 --permission-mode bypassPermissions ``` The request specification at line 345 defines `task_description` as a required string containing the programming task and its context. ### Technical Analysis The command template inserts `project_dir` and `task_description` into a command interpreted by a shell. Double quotes do not safely encode arbitrary shell input. If a caller constructs the final command through direct textual substitution, an embedded quote can terminate the intended argument, while command substitution and shell metacharacters can introduce additional commands. For example, a task description containing a closing quotation mark followed by shell syntax can escape the `-p` argument if the implementation substitutes it verbatim. A malicious project path can similarly escape the `cd` argument. The exact exploit syntax depends on the shell used by the Agent's execution tool, but the template does not prescribe shell-independent argument handling or validation. ### Attack Path 1. An attacker controls or influences the task description, project directory, repository instructions, or content copied into the delegated prompt. 2. The Agent substitutes that value directly into the documented command string. 3. The execution tool passes the constructed string to a shell. 4. Crafted quoting or metacharacters terminate the intended argument and append another shell operation. 5. The injected command executes with the Agent process's operating-system privileges. 6. Because the workflow already recommends bypassing permission checks, filesystem effects may occur without an additional approval prompt. ### Impact Assessment Successful exploitation can execute arbitrary local commands under ...[truncated 308 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims commands run in a 'safe sandbox', but elsewhere it explicitly instructs use of --permission-mode bypassPermissions, which grants broad filesystem write capability. This contradiction can mislead users and downstream agents into trusting an execution path that is not sandboxed, increasing the chance of destructive file changes or secret exposure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L38 declares an absolute rule: 'you never directly write code' and all programming tasks must be delegated through ai-assistant -p. However, L297 says that if the user explicitly asks 'you write it', the assistant may write code itself. That is a direct contradiction of the stated core rule, not merely an omitted exception.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill endorses bypassPermissions and only treats missing write protection as a warning, allowing execution to proceed with broad read/write access. Without a mandatory, explicit warning and user confirmation before each elevated execution, an agent may modify arbitrary repository files, configs, or nearby sensitive data with insufficient operator awareness.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The auto-trigger conditions are broad enough to route many normal development actions into delegated command execution, including file edits, testing, builds, and architecture tasks. In a skill that uses permission bypass, this increases the likelihood of unintended command execution and reduces opportunities for informed user consent at the moment risk is introduced.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The description is primarily in Chinese but embeds the directive Use when ... in English, creating a language expectation that is not presented as a user choice or opt-in. This can be a locale/language policy issue because the skill does not explicitly state which language it will use or offer language selection.
Content: No source excerpt is available for this finding.