Claude Code Task

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:22 PM UTC
• Version: 1.2.5

Overview

This skill does what it says, but it gives a background coding agent broad unsupervised authority and exposes messaging credentials and task output in risky ways.

Install only if you are comfortable with a detached Claude Code process reading and modifying the selected project without normal permission prompts and sending prompts/results to Telegram or WhatsApp. Avoid using it on sensitive repositories or secrets-heavy environments unless it is sandboxed, tokens are scoped/rotated, and temporary output handling is fixed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: run-task.py:513

Finding

Receiving-Agent Instruction Hijacking Through Completion Notifications

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: run-task.py:1060

Finding

Claude Code Is Launched With Permission Enforcement Disabled

Content

View full analysis

"$OUTPUT_FILE" 2>&1 ``` ### Technical Analysis The `--dangerously-skip-permissions` option disables Claude Code's normal permission-confirmation boundary. This is applied unconditionally to every task, regardless of whether the task requires command execution, broad filesystem access, or access outside the selected project. Asynchronous task execution and notification do not inherently require unrestricted local authority. The Skill therefore exceeds minimum privilege by granting the delegated model broad execution capabilities without interactive approval. The risk is amplified because task inputs and repository content may be untrusted. A malicious instruction embedded in a repository file, issue description, generated document, or user prompt may induce Claude Code to execute commands or access files that would otherwise require confirmation. ### Attack Path 1. An attacker supplies or influences a task, repository file, build script, documentation file, or other content Claude Code reads. 2. The content instructs Claude Code to execute a sensitive command, modify files, or read credentials. 3. The Skill starts Claude Code with `--dangerously-skip-permissions`. 4. Claude Code performs the requested tool action without presenting the user with the normal permission gate. 5. The attacker-controlled task can access or modify resources available to the operating-system account running the ...[truncated 669 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: run-task.py:1024

Finding

Telegram Bot Token Exposed in a Predictable Temporary Executable

Content

View full analysis

1 else 'Progress update'\n" f" prefix = '📡 🟢 CC: '\n" f" msg = raw if raw.startswith(prefix) else (prefix + raw)\n" f" payload = json.dumps({{'chat_id': '{_tgt}', 'text': msg, " f"'message_thread_id': {thread_id}, 'disable_notification': True}}).encode()\n" f" req = urllib.request.Request(" f"'https://api.telegram.org/bot{bot_token_for_script}/sendMessage', " f"data=payload, headers={{'Content-Type': 'application/json'}})\n" f" urllib.request.urlopen(req, timeout=10)\n" "except Exception as e:\n" " print(f'notify error: {e}', file=sys.stderr)\n" ) os.chmod(notify_script_path, 0o755) ``` ### Technical Analysis The Skill reads the Telegram bot token from the OpenClaw configuration and interpolates it directly into a generated Python script. The script is stored under a predictable `/tmp/cc-notify-.py` path. The file is initially created using ordinary `open()` semantics and therefore inherits the process umask. More importantly, it is subsequently changed to mode `0755`, making the token-bearing file readable and executable by other local users. Although the Skill attempts to ...[truncated 1515 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: run-task.sh:31

Finding

Arbitrary Python Code Injection in the Legacy Shell Notification Wrapper

Content

View full analysis

/dev/null fi ``` ### Technical Analysis The wrapper builds Python source code inside a shell string and directly interpolates several untrusted values into that source: - Claude Code output through `$RESULT` and `$MSG`. - User-controlled task text through `$TASK`. - The project path through `$PROJECT_DIR`. - The session key through `$SESSION_KEY`. - The gateway token through `$TOKEN`. The use of `msg = '''$MSG'''` does not safely quote the message. A result containing a triple-quote terminator can close the intended Python string and append arbitrary Python statements. Similarly, quotes in the session key can break the single-quoted Python literals. Because the generated Python process already contains the gateway bearer token and imports `requests`, injected code executes with the same OS privileges as the wrapper and can access the gateway credential. ### Attack Path 1. An attacker controls the task text or causes Claude Code to emit specially crafted output. 2. The outpu ...[truncated 1029 chars]

Remediation

View remediation

/dev/null`. 9. Remove the legacy wrapper if `run-task.py` is the supported implementation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: run-task.py:818

Finding

Sensitive Task Results Persist in Predictable Shared Temporary Files

Content

View full analysis

"$OUTPUT_FILE" 2>&1 ``` ### Technical Analysis Task output may contain source code, logs, file contents, access tokens, internal paths, personal information, or other sensitive material. The implementation stores this output in `/tmp` using predictable timestamp-based names. `Path.write_text()` and shell redirection create files according to the current process umask. The code does not explicitly enforce mode `0600`, does not use exclusive creation, does not reject symlinks, and does not remove the output after delivery. The Python CLI also accepts an arbitrary `--output` path without constraining it to a private output directory. If an attacker can influence launch arguments, this could cause task results to overwrite any user-writable target. The session registry itself is protected with mode `0600`, but it retains references to the persistent output files. ### Attack Path 1. A task processes or produces sensitive content. 2. The Skill constructs a predictable `/tmp/cc-.txt` or `/tmp/cc--result.txt` path. 3. The result is written using inherited filesystem permissions. 4. Another local process guesses or enumerates the path and reads the retained output. 5. Alternatively, an attacker pre-creates a matching path or symlink an ...[truncated 683 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documented behavior materially expands beyond the top-level description: direct Telegram messaging, session discovery, local session-file inspection, wake delivery, and iterative orchestration all introduce extra trust and data-flow boundaries. When a skill's declared purpose omits these behaviors, users and supervising agents cannot accurately assess exposure, especially where credentials, local metadata, and external messaging are involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented behavior materially expands beyond the top-level description: direct Telegram messaging, session discovery, local session-file inspection, wake delivery, and iterative orchestration all introduce extra trust and data-flow boundaries. When a skill's declared purpose omits these behaviors, users and supervising agents cannot accurately assess exposure, especially where credentials, local metadata, and external messaging are involved.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documented behavior materially expands beyond the top-level description: direct Telegram messaging, session discovery, local session-file inspection, wake delivery, and iterative orchestration all introduce extra trust and data-flow boundaries. When a skill's declared purpose omits these behaviors, users and supervising agents cannot accurately assess exposure, especially where credentials, local metadata, and external messaging are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill emphasizes automatic delivery to Telegram/WhatsApp but does not present this as a clear privacy and exfiltration warning. Task prompts, intermediate status, results, and possibly repository-derived content may be transmitted to third-party messaging systems, which is highly sensitive in a coding and analysis context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Launching Claude with --dangerously-skip-permissions grants the spawned agent broad autonomous authority over the project environment, including tool execution and file modification, based on untrusted task text. In the context of a background automation skill with notification and session-routing features, this creates a powerful execution primitive that can be abused for destructive changes, data theft, or lateral movement.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script accesses a sensitive auth token and later transmits task metadata and output using that credential, all without any user-facing notice or consent. Because the task output may include proprietary code or secrets, this creates a meaningful risk of unintended data disclosure and abuse of operator credentials.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill delegates the supplied task and project context to an external model tool (claude) without clearly constraining provider behavior or disclosing associated data handling. In a coding automation skill, sending repository content and prompts to an external model is expected, but it still raises confidentiality and control risks, especially when combined with disabled permission checks.

Content

Scanner excerpt · run-task.sh (reported line 23)May include surrounding context.

sh

GW="http://localhost:18789"

# Run Claude Code
claude -p "$TASK" \
  --dangerously-skip-permissions \
  --output-format text \
  > "$OUTPUT_FILE" 2>&1

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Invoking Claude with --dangerously-skip-permissions disables an important safety boundary while running on a user-specified project directory. In this skill context, that materially increases the chance that model-directed actions modify files or execute risky operations without normal safeguards.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill exposes capabilities equivalent to shell execution, file read/write, and network messaging, but declares no explicit tool scope or permission boundaries. That makes the skill far more powerful than its metadata suggests and increases the chance of unsafe invocation, overbroad delegation, and unnoticed data exfiltration through external channels.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is framed as appropriate for a very broad class of tasks, effectively acting as a general-purpose delegated agent. Overbroad invocation criteria increase the chance it is selected for sensitive tasks involving code execution, file access, web access, and external messaging, even when a narrower/safer skill should be used.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Telling operators to use the skill for "ANY complex task" invites use far outside a least-privilege model. Because this skill can read files, write files, execute commands, and send results to outside messaging platforms, such ambiguity materially increases misuse risk and accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises coding and automation abilities but does not clearly warn users that it may write files, modify repositories, initialize git state, and run shell commands. Missing this warning undermines informed consent and can lead to unexpected integrity-impacting actions on local projects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill explicitly promotes ongoing context, file access, and multi-step automations, indicating persistent state and long-lived execution. In combination with external notification channels and resumable sessions, this expands the window for sensitive data retention and leakage across runs.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

Claude Code is NOT just a coding tool. It's a full-powered AI agent with web search, file access, and deep reasoning. Use it for ANY complex task:

- **Research** — web search, synthesis, competitive analysis, user experience reports
- **Coding** — create tools, scripts, APIs, refactor codebases
- **Analysis** — read and analyze files, data, logs, source code
- **Content** — write docs, presentations, reports, summaries
- **Automations** — complex multi-step workflows with file system access

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Using nohup to detach work and save prompts/logs in /tmp creates durable artifacts outside the immediate user interaction. Those files can contain sensitive task text or outputs, and detached background processes reduce user visibility into what continues running after launch.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

write /tmp/cc-prompt.txt with your task text

# Step 2: Launch with $(cat ...)
nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:whatsapp:group:<JID>" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

This launch pattern creates an asynchronous detached run tied to a persistent session key, extending execution beyond the initiating turn. That persistence increases the risk of unnoticed continued access to project files and later external delivery of outputs.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

bash

# ALWAYS use the current thread session key from context:
# agent:main:main:thread:<THREAD_ID>
nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:<THREAD_ID>" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

Waking an exact thread session and continuing across turns is a form of persistent conversational state that can carry sensitive context forward. If session resolution is wrong or compromised, outputs may be delivered to the wrong target or prior context may influence later actions unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

Use --notify-session-id to wake the exact thread session:

bash

nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:369520" \

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The documented use of --dangerously-skip-permissions removes confirmation gates for a general-purpose agent that can access files, run commands, and perform multi-step actions. In this context, bypassing approval increases the risk of unintended destructive actions, secret exposure, or unreviewed outbound operations.

Content

Scanner excerpt · SKILL.md (reported line 358)May include surrounding context.

md

## Claude Code Flags

- `-p "task"` — print mode (non-interactive, outputs result)
- `--dangerously-skip-permissions` — no confirmation prompts
- `--verbose --output-format stream-json` — real-time activity tracking for heartbeats

### Why NOT exec/pty?

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 436)May include surrounding context.

md

cat > /tmp/cc-full-test-prompt.txt << 'EOF'
# ~10 lines, but total >4500 chars:
# 1) notify script now
# 2) create test file with repeated text (to exceed 4500 chars)
# 3) sleep 70 + notify script again
# 4) run several shell commands
# 5) return short structured report

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The full E2E test flow creates long-running detached tasks, temporary prompt files, logs, and output artifacts in /tmp. Even in test mode, these persistent artifacts can expose sensitive data or normalize unsafe background execution patterns in production contexts.

Content

Scanner excerpt · SKILL.md (reported line 448)May include surrounding context.

md

--session "agent:main:main:thread:<THREAD_ID>" \
  --validate-only

nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-full-test-prompt.txt)" \
  --project /tmp/cc-e2e-project \
  --session "agent:main:main:thread:<THREAD_ID>" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

This example explicitly creates a tool and runs it asynchronously in a project context, implying repository modification plus persistent logs and background execution. Without strong consent and cleanup controls, that can leave unexpected code changes and artifacts after the initiating interaction ends.

Content

Scanner excerpt · SKILL.md (reported line 465)May include surrounding context.

WhatsApp: Create a tool

bash

nohup python3 {baseDir}/run-task.py \
  -t "Create a Python CLI tool that converts markdown to HTML with syntax highlighting. Save as convert.py" \
  -p ~/projects/md-converter \
  -s "agent:main:whatsapp:group:[e-mail]" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Detached research runs against a codebase preserve context and may later deliver findings externally, increasing both retention and disclosure risk. Users may not expect repository contents analyzed in the background to be summarized into external chat systems.

Content

Scanner excerpt · SKILL.md (reported line 474)May include surrounding context.

Telegram: Research codebase (thread-safe)

bash

nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:<THREAD_ID>" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Threaded-mode research further couples persistent execution with routing metadata and session continuity. This broadens the attack surface from simple persistence to possible misdelivery of persisted context into a wrong thread if routing data is stale or resolved incorrectly.

Content

Scanner excerpt · SKILL.md (reported line 484)May include surrounding context.

Telegram Threaded Mode: Research codebase

bash

nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:369520" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The mid-task update example stores task data in temp files and relies on a persistent on-disk helper script during execution. These durable artifacts can expose intermediate work product and increase risk if the temp path is accessible to other local users or processes.

Content

Scanner excerpt · SKILL.md (reported line 509)May include surrounding context.

md

STEP 2: Write summary to /tmp/summary.txt...
EOF

nohup python3 {baseDir}/run-task.py \
  --task "$(cat /tmp/cc-prompt.txt)" \
  --project ~/projects/my-project \
  --session "agent:main:main:thread:<THREAD_ID>" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The minimal-mode launch guidance normalizes detached execution with persistent session state as the default workflow. That increases the likelihood of background tasks continuing outside user awareness and later posting outputs into external communications channels.

Content

Scanner excerpt · SKILL.md (reported line 532)May include surrounding context.

md

>   --validate-only
>
> # 2) Real launch (only 3 required params)
> nohup python3 {baseDir}/run-task.py \
>   --task "$(cat /tmp/prompt.txt)" \
>   --project ~/projects/x \
>   --session "agent:main:main:thread:<THREAD_ID>" \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

A long task with extended timeout keeps code-modifying and notification-capable automation running for up to an hour or more, increasing opportunity for unintended actions and prolonged exposure of sensitive context. The risk is operational rather than inherently malicious, but material.

Content

Scanner excerpt · SKILL.md (reported line 549)May include surrounding context.

Long task with extended timeout

bash

nohup python3 {baseDir}/run-task.py \
  -t "Refactor the entire auth module to use JWT tokens" \
  -p ~/projects/backend \
  -s "agent:main:whatsapp:group:[e-mail]" \

Static analysis

No suspicious patterns detected.