Claude Code Task

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:22 PM UTC
• Version: 1.2.5

Overview

This skill does what it says, but it gives a background coding agent broad unsupervised authority and exposes messaging credentials and task output in risky ways.

Install only if you are comfortable with a detached Claude Code process reading and modifying the selected project without normal permission prompts and sending prompts/results to Telegram or WhatsApp. Avoid using it on sensitive repositories or secrets-heavy environments unless it is sandboxed, tokens are scoped/rotated, and temporary output handling is fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: run-task.py:513
• Finding: Receiving-Agent Instruction Hijacking Through Completion Notifications<![CDATA[ ## Vulnerability Details **File Location**: `run-task.py:513-524` **Vulnerability Type**: Agent-session instruction injection and response redirection **Risk Level**: Critical ### Vulnerable Code ```python agent_msg = ( f"[CLAUDE_CODE_RESULT]\n{message}\n\n" f"---\n" f"⚠️ INSTRUCTION: You received a Claude Code result. " f"Process it, then send your response to the WhatsApp group using " f"message(action=send, channel=whatsapp, target={target or 'GROUP_JID'}, message=YOUR_SUMMARY). " f"Then reply NO_REPLY to avoid duplicate. Do NOT rely on announce step." ) try: resp = requests.post( f"{GW_URL}/tools/invoke", headers={"Authorization": f"Bearer {token}", "Content-Type": "application/json"}, json={"tool": "sessions_send", ``` Related continuation instructions are also constructed and delivered through `openclaw agent --deliver` at `run-task.py:559-619`. In iterative mode, those instructions direct the receiving agent to evaluate whether another autonomous run should be launched. ### Technical Analysis The implementation does not deliver Claude Code output as inert, structured result data. It combines task output with imperative instructions and inserts the resulting message into another active agent session. The injected instructions control several aspects of the receiving agent's behavior: - They require the agent to process and summarize the supplied result. - They redirect the response to a specified WhatsApp group. - They require a `NO_REPLY` response to suppress ordinary session output. - Related iterative-mode instructions can direct the agent to initiate another Claude Code execution. This crosses the boundary between result notification and control of the receiving agent's goals and tools. Since `message` includes Claude-generated task output, untrusted or prompt-injected content is placed adjacent to trusted-looking orchestration instructions in the receiving session. ### Attack Path ...[truncated 1199 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Deliver completion results through a structured event schema rather than natural-language instructions. For example, use fields such as `event_type`, `status`, `result_path`, and `preview`. 2. Do not append behavioral commands such as “send,” “reply,” “continue,” or “launch another iteration” to task results. 3. Keep untrusted Claude output in a clearly typed data field and never concatenate it into an instruction channel. 4. Let trusted host-agent policy determine whether and where a response should be delivered. 5. Require explicit user approval before launching any follow-up iteration. 6. Bind delivery to the original validated session and recipient rather than instructing an agent to invoke a messaging tool with a textual target. 7. Apply strict size and content limits to completion previews inserted into agent sessions. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: run-task.py:1060
• Finding: Claude Code Is Launched With Permission Enforcement Disabled<![CDATA[ ## Vulnerability Details **File Location**: `run-task.py:1060-1062`; secondary occurrence at `run-task.sh:24-27` **Vulnerability Type**: Excessive privileges and permission-control bypass **Risk Level**: High ### Vulnerable Code ```python claude_cmd = ["claude", "-p", task_prompt, "--dangerously-skip-permissions", "--verbose", "--output-format", "stream-json", "--include-partial-messages"] ``` The legacy shell wrapper applies the same option: ```bash claude -p "$TASK" \ --dangerously-skip-permissions \ --output-format text \ > "$OUTPUT_FILE" 2>&1 ``` ### Technical Analysis The `--dangerously-skip-permissions` option disables Claude Code's normal permission-confirmation boundary. This is applied unconditionally to every task, regardless of whether the task requires command execution, broad filesystem access, or access outside the selected project. Asynchronous task execution and notification do not inherently require unrestricted local authority. The Skill therefore exceeds minimum privilege by granting the delegated model broad execution capabilities without interactive approval. The risk is amplified because task inputs and repository content may be untrusted. A malicious instruction embedded in a repository file, issue description, generated document, or user prompt may induce Claude Code to execute commands or access files that would otherwise require confirmation. ### Attack Path 1. An attacker supplies or influences a task, repository file, build script, documentation file, or other content Claude Code reads. 2. The content instructs Claude Code to execute a sensitive command, modify files, or read credentials. 3. The Skill starts Claude Code with `--dangerously-skip-permissions`. 4. Claude Code performs the requested tool action without presenting the user with the normal permission gate. 5. The attacker-controlled task can access or modify resources available to the operating-system account running the ...[truncated 669 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--dangerously-skip-permissions` from both launch implementations. 2. Use Claude Code's normal approval mechanism for filesystem, shell, and network operations. 3. Run tasks in an isolated container, VM, or dedicated low-privilege account. 4. Mount only the requested project directory and expose it with the minimum necessary write permissions. 5. Deny access to home-directory credentials, SSH keys, OpenClaw configuration, browser profiles, and unrelated repositories. 6. Apply an allowlist for required commands and network destinations. 7. Separate notification privileges from task-execution privileges so the Claude process never needs gateway or messaging credentials. 8. Require explicit user confirmation before destructive commands, access outside the project, or follow-up autonomous runs. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: run-task.py:1024
• Finding: Telegram Bot Token Exposed in a Predictable Temporary Executable<![CDATA[ ## Vulnerability Details **File Location**: `run-task.py:1024-1050` **Vulnerability Type**: Plaintext credential exposure and insecure temporary-file handling **Risk Level**: High ### Vulnerable Code ```python if thread_id and _ch == "telegram" and _tgt: bot_token_for_script = get_telegram_bot_token() if bot_token_for_script: notify_script_path = f"/tmp/cc-notify-{os.getpid()}.py" with open(notify_script_path, "w") as _nf: _nf.write( "#!/usr/bin/env python3\n" "import sys, json\n" "try:\n" " import urllib.request\n" f" raw = sys.argv[1] if len(sys.argv) > 1 else 'Progress update'\n" f" prefix = '📡 🟢 CC: '\n" f" msg = raw if raw.startswith(prefix) else (prefix + raw)\n" f" payload = json.dumps({{'chat_id': '{_tgt}', 'text': msg, " f"'message_thread_id': {thread_id}, 'disable_notification': True}}).encode()\n" f" req = urllib.request.Request(" f"'https://api.telegram.org/bot{bot_token_for_script}/sendMessage', " f"data=payload, headers={{'Content-Type': 'application/json'}})\n" f" urllib.request.urlopen(req, timeout=10)\n" "except Exception as e:\n" " print(f'notify error: {e}', file=sys.stderr)\n" ) os.chmod(notify_script_path, 0o755) ``` ### Technical Analysis The Skill reads the Telegram bot token from the OpenClaw configuration and interpolates it directly into a generated Python script. The script is stored under a predictable `/tmp/cc-notify-<PID>.py` path. The file is initially created using ordinary `open()` semantics and therefore inherits the process umask. More importantly, it is subsequently changed to mode `0755`, making the token-bearing file readable and executable by other local users. Although the Skill attempts to ...[truncated 1515 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never embed the Telegram bot token in generated source code or command-line arguments. 2. Move notification delivery into a trusted local broker that accepts narrowly scoped messages over an authenticated local socket. 3. Keep messaging credentials entirely outside the Claude Code process and its project workspace. 4. If temporary storage is unavoidable, create a private directory with mode `0700` and use `tempfile` for unpredictable, exclusive file creation. 5. Set credential-bearing files to mode `0600`; do not mark them world-readable or executable. 6. Use short-lived, narrowly scoped credentials where supported. 7. Remove stale helper files during secure startup cleanup, not only during normal shutdown. 8. Ensure logs and exception messages never include Telegram API URLs containing tokens. 9. Rotate the Telegram bot token after deploying the corrected implementation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: run-task.sh:31
• Finding: Arbitrary Python Code Injection in the Legacy Shell Notification Wrapper<![CDATA[ ## Vulnerability Details **File Location**: `run-task.sh:31-49` **Vulnerability Type**: Source-code injection through unsafe shell interpolation **Risk Level**: High ### Vulnerable Code ```bash RESULT=$(head -c 2000 "$OUTPUT_FILE") FULL_SIZE=$(wc -c < "$OUTPUT_FILE") if [ $EXIT_CODE -eq 0 ]; then MSG="✅ Claude Code задача завершена!\n\n**Задача:** ${TASK:0:150}\n**Проект:** $PROJECT_DIR\n**Результат** (${FULL_SIZE} bytes):\n\n${RESULT}\n\n📁 Полный вывод: $OUTPUT_FILE" else MSG="❌ Claude Code ошибка (exit $EXIT_CODE)\n\n**Задача:** ${TASK:0:150}\n**Проект:** $PROJECT_DIR\n\n${RESULT}" fi # Notify via sessions_send if [ -n "$SESSION_KEY" ]; then python3 -c " import json, requests msg = '''$MSG''' requests.post('$GW/tools/invoke', headers={'Authorization': 'Bearer $TOKEN', 'Content-Type': 'application/json'}, json={'tool': 'sessions_send', 'sessionKey': '$SESSION_KEY', 'args': {'sessionKey': '$SESSION_KEY', 'message': msg}}, timeout=30) " 2>/dev/null fi ``` ### Technical Analysis The wrapper builds Python source code inside a shell string and directly interpolates several untrusted values into that source: - Claude Code output through `$RESULT` and `$MSG`. - User-controlled task text through `$TASK`. - The project path through `$PROJECT_DIR`. - The session key through `$SESSION_KEY`. - The gateway token through `$TOKEN`. The use of `msg = '''$MSG'''` does not safely quote the message. A result containing a triple-quote terminator can close the intended Python string and append arbitrary Python statements. Similarly, quotes in the session key can break the single-quoted Python literals. Because the generated Python process already contains the gateway bearer token and imports `requests`, injected code executes with the same OS privileges as the wrapper and can access the gateway credential. ### Attack Path 1. An attacker controls the task text or causes Claude Code to emit specially crafted output. 2. The outpu ...[truncated 1029 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct Python source code from shell-expanded data. 2. Replace the inline `python3 -c` block with a standalone Python program. 3. Pass the message through standard input or a securely opened data file. 4. Pass the session key through an environment variable or argument array and treat it strictly as data. 5. Use `requests.post(..., json=payload)` to serialize content rather than manually generating Python or JSON syntax. 6. Avoid placing bearer tokens in generated source or command-line arguments. 7. Validate the session-key format before use. 8. Check HTTP response codes and report failures securely instead of discarding all errors with `2>/dev/null`. 9. Remove the legacy wrapper if `run-task.py` is the supported implementation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: run-task.py:818
• Finding: Sensitive Task Results Persist in Predictable Shared Temporary Files<![CDATA[ ## Vulnerability Details **File Location**: `run-task.py:818-819` and `run-task.py:1180-1182`; secondary occurrence at `run-task.sh:10,27` **Vulnerability Type**: Insecure temporary files and excessive retention of potentially sensitive output **Risk Level**: Medium ### Vulnerable Code ```python ts = datetime.now().strftime("%Y%m%d-%H%M%S") output_file = args.output or f"/tmp/cc-{ts}.txt" ``` ```python # Save output output = final_text Path(output_file).write_text(output) ``` The shell wrapper uses a similarly shared temporary path: ```bash TASK_ID="cc-$(date +%s)" OUTPUT_FILE="/tmp/${TASK_ID}-result.txt" ``` ```bash claude -p "$TASK" \ --dangerously-skip-permissions \ --output-format text \ > "$OUTPUT_FILE" 2>&1 ``` ### Technical Analysis Task output may contain source code, logs, file contents, access tokens, internal paths, personal information, or other sensitive material. The implementation stores this output in `/tmp` using predictable timestamp-based names. `Path.write_text()` and shell redirection create files according to the current process umask. The code does not explicitly enforce mode `0600`, does not use exclusive creation, does not reject symlinks, and does not remove the output after delivery. The Python CLI also accepts an arbitrary `--output` path without constraining it to a private output directory. If an attacker can influence launch arguments, this could cause task results to overwrite any user-writable target. The session registry itself is protected with mode `0600`, but it retains references to the persistent output files. ### Attack Path 1. A task processes or produces sensitive content. 2. The Skill constructs a predictable `/tmp/cc-<timestamp>.txt` or `/tmp/cc-<epoch>-result.txt` path. 3. The result is written using inherited filesystem permissions. 4. Another local process guesses or enumerates the path and reads the retained output. 5. Alternatively, an attacker pre-creates a matching path or symlink an ...[truncated 683 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store outputs in an application-owned private directory with mode `0700`. 2. Create each output file atomically and exclusively with mode `0600`. 3. Use `tempfile.NamedTemporaryFile` or `mkstemp` with unpredictable names. 4. Reject symlinks and avoid following attacker-controlled filesystem links. 5. Restrict `--output` to an approved directory or require explicit trusted-operator authorization for arbitrary paths. 6. Apply a documented retention period and securely delete expired task outputs. 7. Redact likely credentials and secrets before writing notification previews or persistent output. 8. Avoid exposing full output paths in external notifications unless necessary. 9. Set a restrictive process umask before creating any state, result, or log files. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior materially expands beyond the top-level description: direct Telegram messaging, session discovery, local session-file inspection, wake delivery, and iterative orchestration all introduce extra trust and data-flow boundaries. When a skill's declared purpose omits these behaviors, users and supervising agents cannot accurately assess exposure, especially where credentials, local metadata, and external messaging are involved.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior materially expands beyond the top-level description: direct Telegram messaging, session discovery, local session-file inspection, wake delivery, and iterative orchestration all introduce extra trust and data-flow boundaries. When a skill's declared purpose omits these behaviors, users and supervising agents cannot accurately assess exposure, especially where credentials, local metadata, and external messaging are involved.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented behavior materially expands beyond the top-level description: direct Telegram messaging, session discovery, local session-file inspection, wake delivery, and iterative orchestration all introduce extra trust and data-flow boundaries. When a skill's declared purpose omits these behaviors, users and supervising agents cannot accurately assess exposure, especially where credentials, local metadata, and external messaging are involved.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill emphasizes automatic delivery to Telegram/WhatsApp but does not present this as a clear privacy and exfiltration warning. Task prompts, intermediate status, results, and possibly repository-derived content may be transmitted to third-party messaging systems, which is highly sensitive in a coding and analysis context.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Launching Claude with `--dangerously-skip-permissions` grants the spawned agent broad autonomous authority over the project environment, including tool execution and file modification, based on untrusted task text. In the context of a background automation skill with notification and session-routing features, this creates a powerful execution primitive that can be abused for destructive changes, data theft, or lateral movement.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The script accesses a sensitive auth token and later transmits task metadata and output using that credential, all without any user-facing notice or consent. Because the task output may include proprietary code or secrets, this creates a meaningful risk of unintended data disclosure and abuse of operator credentials.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

GW="http://localhost:18789"

# Run Claude Code
claude -p "$TASK" \
  --dangerously-skip-permissions \
  --output-format text \
  > "$OUTPUT_FILE" 2>&1

• Confidence: 90% confidence
• Finding: The skill delegates the supplied task and project context to an external model tool (`claude`) without clearly constraining provider behavior or disclosing associated data handling. In a coding automation skill, sending repository content and prompts to an external model is expected, but it still raises confidentiality and control risks, especially when combined with disabled permission checks.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Invoking Claude with `--dangerously-skip-permissions` disables an important safety boundary while running on a user-specified project directory. In this skill context, that materially increases the chance that model-directed actions modify files or execute risky operations without normal safeguards.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill exposes capabilities equivalent to shell execution, file read/write, and network messaging, but declares no explicit tool scope or permission boundaries. That makes the skill far more powerful than its metadata suggests and increases the chance of unsafe invocation, overbroad delegation, and unnoticed data exfiltration through external channels.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill is framed as appropriate for a very broad class of tasks, effectively acting as a general-purpose delegated agent. Overbroad invocation criteria increase the chance it is selected for sensitive tasks involving code execution, file access, web access, and external messaging, even when a narrower/safer skill should be used.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: Telling operators to use the skill for "ANY complex task" invites use far outside a least-privilege model. Because this skill can read files, write files, execute commands, and send results to outside messaging platforms, such ambiguity materially increases misuse risk and accidental disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill advertises coding and automation abilities but does not clearly warn users that it may write files, modify repositories, initialize git state, and run shell commands. Missing this warning undermines informed consent and can lead to unexpected integrity-impacting actions on local projects.

Session Persistence

Medium

• Category: Rogue Agent

Content

Claude Code is NOT just a coding tool. It's a full-powered AI agent with web search, file access, and deep reasoning. Use it for ANY complex task:

- **Research** — web search, synthesis, competitive analysis, user experience reports
- **Coding** — create tools, scripts, APIs, refactor codebases
- **Analysis** — read and analyze files, data, logs, source code
- **Content** — write docs, presentations, reports, summaries
- **Automations** — complex multi-step workflows with file system access

• Confidence: 87% confidence
• Finding: The skill explicitly promotes ongoing context, file access, and multi-step automations, indicating persistent state and long-lived execution. In combination with external notification channels and resumable sessions, this expands the window for sensitive data retention and leakage across runs.

Session Persistence

Medium

• Category: Rogue Agent

Content

write /tmp/cc-prompt.txt with your task text

# Step 2: Launch with $(cat ...)
nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:whatsapp:group:<JID>" \

• Confidence: 90% confidence
• Finding: Using `nohup` to detach work and save prompts/logs in `/tmp` creates durable artifacts outside the immediate user interaction. Those files can contain sensitive task text or outputs, and detached background processes reduce user visibility into what continues running after launch.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# ALWAYS use the current thread session key from context:
# agent:main:main:thread:<THREAD_ID>
nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:<THREAD_ID>" \

• Confidence: 90% confidence
• Finding: This launch pattern creates an asynchronous detached run tied to a persistent session key, extending execution beyond the initiating turn. That persistence increases the risk of unnoticed continued access to project files and later external delivery of outputs.

Session Persistence

Medium

• Category: Rogue Agent

Content

Use `--notify-session-id` to wake the exact thread session:

```bash
nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:369520" \

• Confidence: 89% confidence
• Finding: Waking an exact thread session and continuing across turns is a form of persistent conversational state that can carry sensitive context forward. If session resolution is wrong or compromised, outputs may be delivered to the wrong target or prior context may influence later actions unexpectedly.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Claude Code Flags

- `-p "task"` — print mode (non-interactive, outputs result)
- `--dangerously-skip-permissions` — no confirmation prompts
- `--verbose --output-format stream-json` — real-time activity tracking for heartbeats

### Why NOT exec/pty?

• Confidence: 97% confidence
• Finding: The documented use of `--dangerously-skip-permissions` removes confirmation gates for a general-purpose agent that can access files, run commands, and perform multi-step actions. In this context, bypassing approval increases the risk of unintended destructive actions, secret exposure, or unreviewed outbound operations.

Session Persistence

Medium

• Category: Rogue Agent

Content

cat > /tmp/cc-full-test-prompt.txt << 'EOF'
# ~10 lines, but total >4500 chars:
# 1) notify script now
# 2) create test file with repeated text (to exceed 4500 chars)
# 3) sleep 70 + notify script again
# 4) run several shell commands
# 5) return short structured report

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

--session "agent:main:main:thread:<THREAD_ID>" \
  --validate-only

nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-full-test-prompt.txt)" \
  --project /tmp/cc-e2e-project \
  --session "agent:main:main:thread:<THREAD_ID>" \

• Confidence: 88% confidence
• Finding: The full E2E test flow creates long-running detached tasks, temporary prompt files, logs, and output artifacts in `/tmp`. Even in test mode, these persistent artifacts can expose sensitive data or normalize unsafe background execution patterns in production contexts.

Session Persistence

Medium

• Category: Rogue Agent

Content

### WhatsApp: Create a tool
```bash
nohup python3 {baseDir}/run-task.py \
  -t "Create a Python CLI tool that converts markdown to HTML with syntax highlighting. Save as convert.py" \
  -p ~/projects/md-converter \
  -s "agent:main:whatsapp:group:[e-mail]" \

• Confidence: 86% confidence
• Finding: This example explicitly creates a tool and runs it asynchronously in a project context, implying repository modification plus persistent logs and background execution. Without strong consent and cleanup controls, that can leave unexpected code changes and artifacts after the initiating interaction ends.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Telegram: Research codebase (thread-safe)
```bash
nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:<THREAD_ID>" \

• Confidence: 88% confidence
• Finding: Detached research runs against a codebase preserve context and may later deliver findings externally, increasing both retention and disclosure risk. Users may not expect repository contents analyzed in the background to be summarized into external chat systems.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Telegram Threaded Mode: Research codebase
```bash
nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:369520" \

• Confidence: 88% confidence
• Finding: Threaded-mode research further couples persistent execution with routing metadata and session continuity. This broadens the attack surface from simple persistence to possible misdelivery of persisted context into a wrong thread if routing data is stale or resolved incorrectly.

Session Persistence

Medium

• Category: Rogue Agent

Content

STEP 2: Write summary to /tmp/summary.txt...
EOF

nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:<THREAD_ID>" \

• Confidence: 90% confidence
• Finding: The mid-task update example stores task data in temp files and relies on a persistent on-disk helper script during execution. These durable artifacts can expose intermediate work product and increase risk if the temp path is accessible to other local users or processes.

Session Persistence

Medium

• Category: Rogue Agent

Content

>   --validate-only
>
> # 2) Real launch (only 3 required params)
> nohup python3 {baseDir}/run-task.py \
>   --task "$(cat /tmp/prompt.txt)" \
>   --project ~/projects/x \
>   --session "agent:main:main:thread:<THREAD_ID>" \

• Confidence: 87% confidence
• Finding: The minimal-mode launch guidance normalizes detached execution with persistent session state as the default workflow. That increases the likelihood of background tasks continuing outside user awareness and later posting outputs into external communications channels.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Long task with extended timeout
```bash
nohup python3 {baseDir}/run-task.py \
  -t "Refactor the entire auth module to use JWT tokens" \
  -p ~/projects/backend \
  -s "agent:main:whatsapp:group:[e-mail]" \

• Confidence: 86% confidence
• Finding: A long task with extended timeout keeps code-modifying and notification-capable automation running for up to an hour or more, increasing opportunity for unintended actions and prolonged exposure of sensitive context. The risk is operational rather than inherently malicious, but material.

Static analysis

No suspicious patterns detected.