Docker Claude Code Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:10 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Docker setup guide, but it recommends unsafe defaults that can expose a writable web shell and grant broad persistent agent permissions.

Review before installing. Do not expose the ttyd port to a public or shared network unless it is bound to localhost or protected by strong authentication and network controls. Avoid the wildcard Claude Code permission examples, keep secrets out of persistent workspace files where possible, and prefer pinned or verified installation steps over curl-to-bash.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install-acpx.sh:8
• Finding: Unverified Remote Script Executed with Elevated Privileges<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:21-22` - `scripts/install-acpx.sh:8-11` - `references/claude-code-installation.md:13-16` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://deb.nodesource.com/setup_20.x | bash - apt-get install -y nodejs ``` The executable installer repeats the same behavior: ```bash if ! command -v node &> /dev/null; then echo "Installing Node.js..." curl -fsSL https://deb.nodesource.com/setup_20.x | bash - apt-get install -y nodejs fi ``` ### Technical Analysis The downloaded response is passed directly to Bash without being saved, inspected, version-pinned, or verified against a trusted cryptographic signature or checksum. The subsequent use of `apt-get` indicates that the instructions or script are expected to run with root-level privileges, particularly in a Docker container. NodeSource is a recognizable provider, but the endpoint serves mutable content. Trust in the current domain owner does not protect against DNS compromise, TLS termination compromise, upstream infrastructure compromise, or an unintended future modification to the remote installer. This behavior exceeds the minimum privilege necessary to install Node.js because safer package installation and verification methods are available. ### Attack Path 1. An attacker compromises the remote endpoint, its delivery infrastructure, DNS resolution, or another component capable of changing the HTTP response. 2. A user or agent follows the Skill instructions or invokes `scripts/install-acpx.sh` in a privileged container. 3. `curl` retrieves the attacker-controlled response. 4. The shell executes that response immediately through the pipe. 5. The payload runs with the invoking user's privileges, potentially root inside the container. 6. The payload can alter package repositories, install additional software, access mounted secrets, or modify ...[truncated 420 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pipe network responses directly into a shell. 2. Prefer Node.js packages supplied by the operating system or a repository configured through a versioned container image. 3. If the NodeSource installer is required: - Download it to a local file. - Pin the expected installer version or immutable artifact. - Verify a vendor-published cryptographic signature or checksum through an independent trusted channel. - Review the downloaded script before execution. 4. Run repository setup with elevated privileges only for the commands that require them. 5. Pin Node.js and npm package versions rather than installing mutable latest releases. 6. In Docker, install dependencies during a reproducible image-build stage instead of at runtime. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/start-ttyd.sh:29
• Finding: Unauthenticated Writable Web Terminal Exposes an Interactive Shell<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/start-ttyd.sh:29-35` - `references/ttyd-tmux-setup.md:53-58` - `references/ttyd-tmux-setup.md:91-94` - `SKILL.md:37-43` **Vulnerability Type**: Missing authentication and transport protection on a writable remote terminal **Risk Level**: Critical ### Vulnerable Code ```bash # Kill existing ttyd pkill -9 ttyd 2>/dev/null || true sleep 1 # Start ttyd with tmux echo "=== Starting ttyd + tmux ===" nohup ttyd -p $PORT -W bash -c "export LANG=zh_CN.UTF-8; cd $WORKSPACE && tmux new -A -s main" > /tmp/ttyd.log 2>&1 & ``` The accompanying guidance explicitly enables writable access and advertises external access: ```bash # Basic startup ttyd -p 6080 -W tmux new -A -s main # Startup with environment variables ttyd -p 6080 -W bash -c "export LANG=zh_CN.UTF-8; export MY_VAR=value; tmux new -A -s main" ``` ```text - Local: http://localhost:6080 - External: http://YOUR_IP:6080 ``` No authentication option, loopback-only bind, TLS configuration, firewall restriction, or other mandatory access control is configured. The `-W` option grants terminal write capability, and all visitors attach to the persistent `main` tmux session. ### Technical Analysis A web terminal is equivalent to remote shell access. Enabling write access without authentication breaks the system's access-control boundary. Unless the environment independently restricts the listener, ttyd may be reachable through the container or host network. Advertising the external URL increases the likelihood that the port will be published or exposed. The shared tmux session compounds the issue because an unauthenticated visitor may observe an existing authenticated session, terminal history, environment-derived credentials, active commands, and filesystem content. HTTPS alone would not correct the missing authorization; it only protects traffic in transit. This exposure is unnecessary for the declared functionality. Persistent browser terminal acc ...[truncated 1157 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind ttyd explicitly to `127.0.0.1` rather than all available interfaces. 2. Place it behind an authenticated reverse proxy or access it only through SSH/VPN tunneling. 3. Require strong authentication and enforce authorization independently of network location. 4. Use TLS for all non-loopback traffic and verify that WebSocket traffic is also protected. 5. Do not publish the ttyd port directly from Docker to an untrusted network. 6. Apply host firewall and container-network rules limiting access to approved administration sources. 7. Avoid `-W` for users who need view-only access. 8. Do not attach every remote visitor to a shared privileged tmux session. 9. Run ttyd as a dedicated non-root user with a restricted workspace, minimal environment, and no access to sensitive mounts. 10. Add explicit warnings that external HTTP exposure is unsafe; HTTPS without authentication is insufficient. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/claude-code-installation.md:52
• Finding: Blanket Claude Code Permissions Disable Least-Privilege Controls<![CDATA[ ## Vulnerability Details **File Locations**: - `references/claude-code-installation.md:52-59` - `references/api-configuration.md:92-101` **Vulnerability Type**: Unrestricted preauthorization of file and shell operations **Risk Level**: High ### Vulnerable Code ```json { "permissions": { "allow": [ "Read(**)", "Edit(**)", "Write(**)", "Bash(**)" ] } } ``` ### Technical Analysis The proposed local settings grant unrestricted read, edit, write, and Bash permissions. The `**` patterns are not limited to the intended project or to a small set of required commands. This removes interactive approval boundaries that would otherwise constrain an AI coding agent. AI agents process potentially attacker-controlled repository content, including source files and project-level instructions such as `CLAUDE.md`. If that content induces an unsafe tool call, these permissions allow the action to proceed without a narrowly scoped authorization decision. Persistent placement in `~/.claude/settings.local.json` also means the excessive grant can affect subsequent projects and sessions. The declared setup functionality does not require permanent, unrestricted shell and filesystem privileges. This configuration therefore exceeds minimum necessary privilege. ### Attack Path 1. The user installs the recommended broad permission configuration. 2. The user opens a malicious or compromised repository with Claude Code. 3. Repository content or project instructions direct the agent to execute an unsafe command or access files outside the project. 4. The unrestricted `Bash(**)`, `Read(**)`, `Edit(**)`, and `Write(**)` rules satisfy the permission check. 5. The agent executes commands, reads secrets, or modifies files without a meaningful approval boundary. 6. Stolen data can be sent through an allowed command or to a configured external API endpoint. ### Impact Assessment The effective scope includes arbitrary files accessible to the Claude ...[truncated 303 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the blanket permission configuration from the setup guide. 2. Keep interactive approval enabled for shell execution and access outside the active project. 3. Scope file rules to the specific workspace rather than using `**`. 4. Allowlist only narrowly required commands and arguments. 5. Deny access to SSH keys, cloud credentials, environment files, secret stores, and system directories. 6. Use a dedicated unprivileged operating-system user for Claude Code. 7. Mount only the required project directory into the container and use read-only mounts where possible. 8. Maintain separate project-specific settings instead of persistent global grants. 9. Warn users that project instruction files are untrusted input and should be reviewed before agent execution. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/start-ttyd.sh:7
• Finding: Unsafe Shell Construction and Global Process Termination in ttyd Launcher<![CDATA[ ## Vulnerability Details **File Location**: `scripts/start-ttyd.sh:7-8, 29-35` **Vulnerability Type**: Shell injection exposure and overbroad process termination **Risk Level**: Medium ### Vulnerable Code ```bash PORT=${1:-6080} WORKSPACE="${HOME}/workspace/claude-code" ``` ```bash # Kill existing ttyd pkill -9 ttyd 2>/dev/null || true sleep 1 # Start ttyd with tmux echo "=== Starting ttyd + tmux ===" nohup ttyd -p $PORT -W bash -c "export LANG=zh_CN.UTF-8; cd $WORKSPACE && tmux new -A -s main" > /tmp/ttyd.log 2>&1 & ``` ### Technical Analysis `$WORKSPACE`, which incorporates the environment-controlled value of `$HOME`, is interpolated into a command string passed to `bash -c` without shell escaping. Shell metacharacters in the value can alter the nested command. `$PORT` is also unquoted and is not validated as a numeric TCP port, permitting argument splitting and option confusion. Separately, `pkill -9 ttyd` terminates every process with the matching name that the current user is allowed to signal. It does not verify that a process belongs to this script, uses the requested port, or is the intended service instance. `SIGKILL` also prevents graceful cleanup. ### Attack Path A shell-injection exploitation path is: 1. An attacker gains influence over the script's environment, particularly `HOME`, or over how the launcher is invoked. 2. The script constructs `WORKSPACE` from the attacker-influenced value. 3. That value is inserted into the quoted string supplied to `bash -c`. 4. Shell metacharacters in the interpolated value are interpreted by the nested Bash process. 5. Attacker-selected commands execute with the launcher's privileges. A denial-of-service path is: 1. Other ttyd instances are running under the same account or a privileged account. 2. The script is invoked. 3. `pkill -9 ttyd` forcibly terminates all matching instances, including unrelated services. 4. Existing terminal users lose their sessions and unsaved state. ### Impact As ...[truncated 386 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate the port with a strict numeric expression and enforce the range 1–65535. 2. Quote all variable expansions used as command arguments. 3. Avoid constructing a command string for `bash -c`. 4. Change the working directory in the parent script and invoke tmux through a direct argument array. 5. If a nested shell is unavoidable, pass values as positional parameters rather than interpolating them into command text. 6. Record the PID of the ttyd process started by this launcher. 7. Stop only that recorded process after checking its identity and ownership. 8. Use graceful termination before considering `SIGKILL`. 9. Refuse to overwrite or interfere with an existing unrelated listener on the selected port. 10. Treat `HOME` and other environment variables as untrusted when the script can run across privilege boundaries. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/acpx-setup.md:19
• Finding: API Keys Are Encouraged in Plaintext Persistent Configuration<![CDATA[ ## Vulnerability Details **File Locations**: - `references/acpx-setup.md:19-34` - `references/api-configuration.md:33-40` - `references/api-configuration.md:64-73` **Vulnerability Type**: Insecure plaintext credential storage **Risk Level**: Medium ### Vulnerable Code ```json { "defaultAgent": "claude-code", "agents": { "claude-code": { "command": "claude", "args": [], "env": { "ANTHROPIC_API_KEY": "your-key-here" } }, "codex": { "command": "codex", "args": [], "env": { "OPENAI_API_KEY": "your-key-here" } } } } ``` The API guide also recommends a plaintext environment file: ```env ANTHROPIC_API_KEY=your-api-key ANTHROPIC_BASE_URL=https://api.example.com/v1 ANTHROPIC_MODEL=model-name ``` Persistent storage is created without explicit restrictive permissions: ```bash # Store configuration in a persistent directory mkdir -p ~/workspace/.claude mkdir -p ~/workspace/.env # Create symbolic link ln -sf ~/workspace/.claude ~/.claude ``` ### Technical Analysis The documentation encourages embedding API keys directly in `~/.acpx/config.json` or a project `.env` file. It does not require file mode `0600`, directory mode `0700`, secret-manager integration, or protection against inclusion in backups and shared workspace volumes. The command `mkdir -p ~/workspace/.env` creates a directory named `.env`, not an environment file, and does not secure any eventual credential file. Persisting secrets under the workspace can expose them to other users, mounted containers, backup systems, coding agents with broad read permissions, or visitors to the unauthenticated web terminal. ### Attack Path 1. A user follows the guide and stores a live API key in `.env` or `~/.acpx/config.json`. 2. The file remains in a persistent workspace or mounted volume with default permissions. 3. Another local process, container user, backup consumer, coding agent, or ttyd visitor reads the file. 4. T ...[truncated 543 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not embed live API keys in agent configuration files. 2. Inject secrets at runtime through a Docker/Kubernetes secret mechanism or a dedicated secret manager. 3. If a file is unavoidable, create it with mode `0600` inside a directory with mode `0700`. 4. Keep secret files outside project workspaces and source-controlled directories. 5. Add `.env`, `.env.*`, and agent credential files to ignore rules, while allowing only non-secret templates such as `.env.example`. 6. Exclude credentials from persistent backups and shared volume snapshots. 7. Run coding agents and ttyd under accounts that cannot read unrelated secrets. 8. Use narrowly scoped provider keys, spending limits, expiration where supported, and regular rotation. 9. Correct the documentation so that `.env` is created as a protected file rather than a directory. 10. Warn users that environment variables can also leak through child processes, diagnostic output, and session inspection. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Credential Access

High

• Category: Privilege Escalation

Content

claude
```

### 方法 2: .env 文件

在项目目录创建 `.env`:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

claude
```

### 方法 2: .env 文件

在项目目录创建 `.env`:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 在持久化目录存储配置
mkdir -p ~/workspace/.claude
mkdir -p ~/workspace/.env

# 创建符号链接
ln -sf ~/workspace/.claude ~/.claude

• Confidence: 79% confidence
• Finding: The Docker persistence guidance suggests creating ~/workspace/.env in a persistent workspace, which can encourage storing secrets in a long-lived, potentially shared or mounted path inside container environments. In Docker/OpenClaw-style setups, persisted workspaces are often easier to copy, back up, or accidentally commit, increasing the chance of API key disclosure.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### 4. 权限配置

创建 `~/.claude/settings.local.json`:

```json
{

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

### 4. 权限配置

创建 `~/.claude/settings.local.json`:

```json
{

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

| 文件 | 用途 |
|------|------|
| `~/.claude/settings.json` | 全局设置 |
| `~/.claude/settings.local.json` | 本地权限配置 |
| `CLAUDE.md` | 项目级指令文件 |

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

```bash
claude              # 启动交互式会话
claude "task"       # 直接执行任务
claude --print      # 输出到 stdout
claude --help       # 查看帮助
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill includes shell commands and operational setup steps but declares no explicit tool scope or allowed-tools boundary. In an agent setting, this increases the chance that the skill will invoke shell-capable behavior without least-privilege constraints, which can lead to unintended command execution or broader system changes than the user expects.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to start a browser-accessible ttyd terminal and advertises persistent sessions, but it does not warn that this exposes an interactive shell over HTTP. If bound beyond localhost, misconfigured, or left unauthenticated, an attacker could gain remote shell access or hijack an existing session.

Session Persistence

Medium

• Category: Rogue Agent

Content

在 Docker 容器中，将配置目录映射到持久化存储：

```bash
# Create persistent directories / 创建持久化目录
mkdir -p ~/workspace/claude-code/.claude
mkdir -p ~/workspace/.acpx
mkdir -p ~/workspace/.gradle  # For Android projects

• Confidence: 88% confidence
• Finding: The skill recommends persisting directories that may contain credentials, session state, and tool configuration across container lifecycles. This is not inherently malicious, but if those paths are shared, weakly permissioned, or mounted into less-trusted environments, sensitive tokens and history may be exposed or reused by unauthorized parties.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation shows API keys embedded directly in a JSON config file and shell exports without any warning about secret handling, file permissions, or safer alternatives. In a Docker and multi-agent setup, this increases the chance that users store credentials in persistent volumes, shell history, images, or shared configs where they may be exposed to other users or processes.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 创建持久化目录
mkdir -p ~/workspace/.acpx

# 创建符号链接
ln -sf ~/workspace/.acpx ~/.acpx

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

| 提供商 | BASE_URL | 说明 |
|--------|----------|------|
| Anthropic | https://api.anthropic.com | 官方 API |
| 腾讯 Coding | https://api.lkeap.cloud.tencent.com/coding/anthropic | Coding Plan |
| DeepSeek | https://api.deepseek.com | DeepSeek API |
| 百度千帆 | https://aip.baidubce.com/rpc/2.0/ai_custom/v1 | 百度 API |
| 阿里百炼 | https://dashscope.aliyuncs.com/compatible-mode/v1 | 阿里 API |

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 使用代理服务
export ANTHROPIC_API_KEY="your-api-key"
export ANTHROPIC_BASE_URL="https://api.example.com/v1"
export ANTHROPIC_MODEL="model-name"  # 可选

# 启动 Claude Code

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 使用代理服务
export ANTHROPIC_API_KEY="your-api-key"
export ANTHROPIC_BASE_URL="https://api.example.com/v1"
export ANTHROPIC_MODEL="model-name"  # 可选

# 启动 Claude Code

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 使用代理服务
export ANTHROPIC_API_KEY="your-api-key"
export ANTHROPIC_BASE_URL="https://api.example.com/v1"
export ANTHROPIC_MODEL="model-name"  # 可选

# 启动 Claude Code

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 使用代理服务
export ANTHROPIC_API_KEY="your-api-key"
export ANTHROPIC_BASE_URL="https://api.example.com/v1"
export ANTHROPIC_MODEL="model-name"  # 可选

# 启动 Claude Code

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 使用代理服务
export ANTHROPIC_API_KEY="your-api-key"
export ANTHROPIC_BASE_URL="https://api.example.com/v1"
export ANTHROPIC_MODEL="model-name"  # 可选

# 启动 Claude Code

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 使用代理服务
export ANTHROPIC_API_KEY="your-api-key"
export ANTHROPIC_BASE_URL="https://api.example.com/v1"
export ANTHROPIC_MODEL="model-name"  # 可选

# 启动 Claude Code

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 在持久化目录存储配置
mkdir -p ~/workspace/.claude
mkdir -p ~/workspace/.env

# 创建符号链接

• Confidence: 84% confidence
• Finding: The instructions create persistent storage for Claude configuration and link it into the home directory, which can preserve credentials, session artifacts, and permission settings across container restarts. In web-terminal or shared container contexts, this expands the lifetime and recoverability of sensitive state, making post-compromise access or accidental leakage more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to grant Claude unrestricted Read, Edit, Write, and Bash access across all paths using wildcards. In a containerized setup that may be mounted to host workspaces or secrets, this removes meaningful safeguards and can enable destructive file modification, data exposure, or arbitrary command execution without adequate warning or scope limitation.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 创建持久化目录
mkdir -p ~/workspace/claude-code/.claude

# 创建符号链接
ln -sf ~/workspace/claude-code/.claude ~/.claude

• Confidence: 81% confidence
• Finding: Persisting the entire ~/.claude directory into a mounted workspace can retain API keys, conversation history, settings, and other sensitive agent state beyond the container lifecycle. In shared Docker environments or host-mounted directories, this increases the chance of unintended access, leakage, or reuse of privileged configuration by other users or processes.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 或从源码编译
git clone https://github.com/tsl0922/ttyd.git
cd ttyd && mkdir build && cd build
cmake .. && make && make install
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example uses ttyd with the `-W` flag, which enables interactive remote input rather than read-only viewing, but the documentation does not warn that this grants remote users the ability to execute commands in the served shell session. Because the command launches tmux/bash, an exposed writable terminal can be used to run arbitrary commands, access secrets, modify files, or pivot further depending on container permissions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly advertises access via an external IP for a web-exposed terminal but does not mention authentication, network restriction, or that anyone who can reach the port may obtain terminal access. In the context of ttyd serving a shell/tmux session, this can lead to full remote command execution in the container and potentially host-impacting actions depending on container privileges and mounted resources.

Static analysis

No suspicious patterns detected.