Code Delegate

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.1

Overview

This is a Markdown-only code delegation skill with disclosed command execution and setup steps, not evidence of hidden credential theft or malicious behavior.

Install only in a development environment you trust. Prefer a pinned, local CLI install where possible, review the .delegate-toolkit paths before setup, and require confirmation before delegated tasks modify source files, run tests, or use API credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:337

Finding

Unpinned Global Installation of an Executable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 337
Vulnerability Type: Unpinned third-party executable dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown

| Code CLI | CLI tool | Required | `npm install -g @anthropic-ai/claude-code` |

Technical Analysis

The skill directs users to install @anthropic-ai/claude-code globally without specifying an exact reviewed version, lockfile, or package-integrity value.

Because the requested version is not pinned, npm resolves the package version available under the applicable default version tag at installation time. Consequently, the installed artifact can differ from the artifact assessed when this skill was reviewed. npm packages can also define lifecycle scripts that execute during installation unless those scripts are explicitly disabled.

The -g option installs the package into the user's global npm environment and exposes its command globally. This expands the potential impact beyond an isolated project dependency. The documentation does not prescribe provenance validation, integrity verification, lifecycle-script restrictions, or an isolated installation environment.

No evidence indicates that the named package is currently malicious. The vulnerability is the unsafe dependency installation practice and the resulting supply-chain exposure.

Attack Path

1. An attacker compromises the package publisher account, package release process, npm registry delivery path, or another relevant supply-chain component.
2. The attacker publishes a malicious version under the package's normal distribution tag.
3. A user follows the skill's documented command:

   bash

   npm install -g @anthropic-ai/claude-code
   

4. npm resolves and downloads the attacker-controlled release because no exact version or integrity value is required.
5. Malicious package content or installation lifecycle scripts execute with the privileges of the user running npm.
6. The globa ...[truncated 948 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than relying on a mutable distribution tag:

   bash

   npm install --save-dev --save-exact @anthropic-ai/claude-code@<reviewed-version>
   

2. Prefer a project-local installation over -g, and invoke the binary through a package script or another controlled local mechanism.

3. Commit and enforce a lockfile so dependency resolution is reproducible. Use npm ci in automated environments rather than an unconstrained install.

4. Verify package provenance and integrity before use. Document the expected publisher, package source, exact version, and approved integrity digest.

5. Disable lifecycle scripts during installation where operationally feasible:

   bash

   npm ci --ignore-scripts
   

   If lifecycle scripts are necessary, review them before permitting execution.

6. Run dependency installation and the CLI in a least-privileged, isolated environment such as a dedicated container or restricted build worker. Do not install it using an administrator or root account.

7. Add automated dependency scanning and release approval controls. Require review before updating the pinned version or lockfile.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

".skill-platform/",
      "LaunchAgents/",
      "**/auth-profiles/**",
      "**/*.env",
      "**/secrets/**"
    ],
    "allowed_paths": [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md

".skill-platform/",
      "LaunchAgents/",
      "**/auth-profiles/**",
      "**/*.env",
      "**/secrets/**"
    ],
    "allowed_paths": [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

".skill-platform/",
      "LaunchAgents/",
      "**/auth-profiles/**",
      "**/*.env",
      "**/secrets/**"
    ],
    "allowed_paths": [

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.

md

".skill-platform/",
      "LaunchAgents/",
      "**/auth-profiles/**",
      "**/*.env",
      "**/secrets/**"
    ],
    "allowed_paths": [

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises automatic testing, auditing, and report generation after delegated tasks without clearly warning that these actions may execute commands, consume external tooling, and modify project files. In a code-delegation skill with exec capability, that omission increases the risk of unintended code changes or command execution under user trust.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill includes shell setup commands that create directories and write configuration and log-related files into the current workspace, but it does not clearly warn users about those side effects before presenting the commands. In an agent-execution context, undocumented filesystem writes can surprise users, clutter repositories, or overwrite local configuration when instructions are followed automatically.

Content

No source excerpt is available for this finding.