T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:1- Finding
Read-Only Skill Declares Unrestricted Bash Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Claude Automation Recommender
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly an advisory automation recommender, but it asks for broad shell access and recommends powerful automated Claude workflows without enough guardrails.
Review this skill before installing. It is not clearly malicious, but treat its recommendations as powerful automation templates: remove or constrain Bash if you want read-only behavior, do not run headless Edit/Write workflows without review, do not pipe model output directly into commands, pin package tools, and avoid committing secret-bearing MCP configs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
references/skills-reference.md:185- Finding
Unpinned npx Command Can Retrieve and Execute Dependency Code
- Content
View full analysis
&1 || echo "Validation failed" ``` ### Technical Analysis The recommended migration-validation script invokes `npx prisma` without requiring a lockfile-managed local Prisma installation or specifying a verified package version. When a suitable local executable is unavailable, `npx`/`npm exec` may offer to retrieve or may retrieve a package from the configured npm registry, depending on the npm version and execution environment. The resulting package CLI and applicable installation lifecycle behavior execute with the invoking user's privileges. This makes the effective code executed by the generated Skill dependent on mutable registry resolution and local npm configuration rather than code reviewed with the Skill. It exposes users to package compromise, registry substitution, dependency confusion, or unexpected package-version changes. The command also converts validation failure into a successful shell result through: ```bash || echo "Validation failed" ``` Consequently, callers may not receive a nonzero status when validation fails, weakening the integrity control provided by the script. ### Attack Path 1. A user adopts the documented `create-migration` Skill template. 2. The expected local Prisma executable is absent, incorrectly installed, or not selected by package resolution. 3. The generated validation script runs `npx prisma validate`. 4. `npx` resolves the executable using the local environment and configured npm registry; depending on npm behavior and approval settings, it may obtain package code at runtime. 5. A compromised, substituted, or unexpectedly resolved package executes under the developer's account. 6. Malicious package code could inspect project files, envi ...[truncated 1076 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (19)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md **This skill is read-only.** It analyzes the codebase and outputs recommendations. It does NOT create or modify any files. Users implement the recommendations themselves or ask Claude separately to help build them. ## Output Guidelines - **Recommend 1-2 of each type**: Don't overwhelm - surface the top 1-2 most valuable automations per category - **If user asks for a specific type**: Focus only on that type and provide more options (3-5 recommendations)
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
The skill includes explicit guidance to invoke Claude in headless mode with write-capable tools (
Edit,Write) for automated remediation. Even though framed as an example, this normalizes delegated autonomous code modification and can be repurposed in CI or hooks to make unsupervised changes from prompts, increasing the risk of prompt injection, unsafe edits, or policy bypass through automation chains.- Content
bash # Pre-commit hook example claude -p "fix lint errors in src/" --allowedTools Edit,Write # CI pipeline with structured output claude -p "<prompt>" --output-format stream-json | your_command
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The streamed headless invocation pattern enables external automation pipelines to consume model output directly and act on it, potentially without sufficient validation or human review. In a recommendation skill, this expands the role from advisory analysis toward orchestrating autonomous model-driven workflows, which can magnify prompt-injection and supply-chain risks when integrated into CI or shell pipelines.
- Content
claude -p "fix lint errors in src/" --allowedTools Edit,Write
CI pipeline with structured output
claude -p "" --output-format stream-json | your_command
text ### Permissions for Hooks
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Detection | Presence Of | |-----------|-------------| | `.env`, `.env.local`, `.env.production` | Environment files | | `credentials.json`, `secrets.yaml` | Secret files | | `.git/` directory | Git internals | **Recommend**: PreToolUse hook that blocks Edit/Write to these paths
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Detection | Presence Of | |-----------|-------------| | `.env`, `.env.local`, `.env.production` | Environment files | | `credentials.json`, `secrets.yaml` | Secret files | | `.git/` directory | Git internals | **Recommend**: PreToolUse hook that blocks Edit/Write to these paths
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Ruff/Black config | Auto-format Python | | tsconfig.json | Type-check on Edit | | Test directory | Run related tests on Edit | | .env files | Block .env edits | | Lock files | Block lock file edits | | Go project | gofmt on Edit | | Rust project | rustfmt on Edit |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Ruff/Black config | Auto-format Python | | tsconfig.json | Type-check on Edit | | Test directory | Run related tests on Edit | | .env files | Block .env edits | | Lock files | Block lock file edits | | Go project | gofmt on Edit | | Rust project | rustfmt on Edit |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The activation text is broad enough to match many generic requests about improving Claude Code usage, which increases the chance this skill is invoked when a more narrowly scoped skill would be safer or more appropriate. Overbroad auto-selection can expose more tools and instructions than necessary, increasing attack surface and the likelihood of unintended behavior.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file presents the skill as read-only, but later content recommends write-capable automations, hook permissions, and command patterns that enable editing or execution by Claude. This mismatch can mislead users or policy engines about operational risk and cause the skill to be used in contexts where only passive analysis was intended.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill claims to analyze the local codebase with the declared toolset, but it instructs the agent to use web search, which expands data sources and trust boundaries beyond what the user may expect. That can lead to recommendations influenced by untrusted external content or hidden tool assumptions, creating integrity and privacy risks during analysis.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md See [references/skills-reference.md](references/skills-reference.md) for details. Create skills in `.claude/skills/<name>/SKILL.md`. Some are also available via plugins: | Codebase Signal | Skill | Plugin | |-----------------|-------|--------|
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md # Hooks Recommendations Hooks automatically run commands in response to Claude Code events. They're ideal for enforcement and automation that should happen consistently. **Note**: These are common patterns. Use web search to find hooks for tools/frameworks not listed here to recommend the best hooks for the user.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document recommends checking
.mcp.jsoninto git for team-wide sharing, but it does not warn that MCP configuration may contain sensitive server endpoints, auth settings, or references to locally trusted tools. In a skill that advises automation setup, this can normalize unsafe sharing patterns and lead teams to accidentally commit credentials or expose powerful integrations across the repository.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md # Skills Recommendations Skills are packaged expertise with workflows, reference materials, and best practices. Create them in `.claude/skills/<name>/SKILL.md`. Skills can be invoked by Claude automatically when relevant, or by users directly with `/skill-name`. Some pre-built skills are available through official plugins (install via `/plugin install`).
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md --- ## Custom Project Skills Create project-specific skills in `.claude/skills/<name>/SKILL.md`.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
yaml --- name: create-migration description: Create a database migration file disable-model-invocation: true allowed-tools: Read, Write, Bash ---
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This section recommends subagents with Write and Bash capabilities for test generation and related automation, but it does not warn that these tools can modify repository files or execute system commands. In a skill whose purpose is to recommend automations for a codebase, normalizing powerful tool access without explicit guardrails increases the chance that users enable overly permissive agents and trigger unintended code or environment changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The dependency-updater and migration-helper guidance encourages use of Write and Bash for dependency changes and framework migrations but omits warnings about disruptive effects such as lockfile churn, package installation, script execution, configuration drift, or broad refactors. Because these tasks commonly make sweeping project and environment changes, the lack of cautionary language makes unsafe adoption more likely in real repositories.
- Content
Static analysis
No suspicious patterns detected.