Cc Coder

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:52 AM UTC
• Version: 1.0.0

Overview

This coding skill needs review because it broadly delegates programming work to Claude Code with approval checks disabled.

Install only if you intentionally want a coding skill that can invoke Claude Code with approval checks skipped. Use it in a sandboxed workspace or unprivileged account, review generated changes before keeping them, and avoid using it on repositories or machines with secrets, deployment credentials, or unrelated private files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:35
• Finding: Claude Code Permission Checks Are Explicitly Disabled## Vulnerability Details **File Location**: `SKILL.md`, lines 35-43 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High **Vulnerable code:** ```bash claude -p --dangerously-skip-permissions "你的具体要求" ``` The associated parameter documentation explicitly states that `--dangerously-skip-permissions` skips approval checks. ### Technical Analysis The Skill requires every programming task to be delegated to Claude Code with `--dangerously-skip-permissions`. This option disables the permission and approval controls intended to prevent unreviewed file modifications and command execution. Disabling these controls violates least privilege because ordinary code generation, review, and testing do not inherently require unrestricted operation. The nested coding agent receives authority beyond what is necessary for each task, while the Skill defines no restrictions on accessible paths, executable commands, network access, or sensitive files. ### Attack Path 1. An attacker or untrusted source supplies a malicious, ambiguous, or deceptive programming request. 2. The Skill incorporates that request into a Claude Code invocation. 3. Claude Code starts with `--dangerously-skip-permissions`. 4. The nested agent interprets the request as requiring sensitive file access, command execution, or destructive modifications. 5. Those operations proceed without an interactive approval barrier. 6. The attacker may consequently influence files and processes accessible to the account running the Skill. ### Impact Assessment Successful exploitation may permit unapproved modification, creation, or deletion of files within the privileges of the host process. It may also allow execution of local commands, access to sensitive project or user files, alteration of repositories, and interaction with any credentials or services available to the invoking account. The precise scope is bounded by operating-sys ...[truncated 194 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--dangerously-skip-permissions` and retain Claude Code's standard approval workflow. 2. Require explicit approval for shell execution, writes outside the intended project, destructive operations, network access, and access to sensitive files. 3. Run Claude Code in a sandbox or container with only the target workspace mounted as writable. 4. Use a dedicated, unprivileged operating-system account without access to unrelated repositories, personal files, deployment credentials, or host administration interfaces. 5. Define allowlists for permitted commands and filesystem paths. 6. Deny access to SSH keys, cloud credentials, environment-secret files, package publishing tokens, and production configuration unless a specific task requires them. 7. Require review of generated changes and test commands before execution, especially when the original request comes from an untrusted source.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:35
• Finding: User-Controlled Requirements Are Embedded in a Shell Command## Vulnerability Details **File Location**: `SKILL.md`, lines 35-38 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High **Vulnerable code:** ```bash claude -p --dangerously-skip-permissions "你的具体要求" ``` ### Technical Analysis The Skill instructs the agent to place the task requirements directly into a quoted shell command. It does not require argument-array execution, shell escaping, input validation, or delivery through standard input. Double quotes do not neutralize every shell construct. If the placeholder is replaced through direct string interpolation and the result is evaluated by a shell, attacker-controlled requirements containing a double quote can terminate the intended argument. Shell operators can then introduce additional commands. Command substitution constructs may also be evaluated inside double quotes, depending on how the command is assembled and invoked. For example, a requirement containing closing quotation marks followed by shell control operators could transform one intended Claude prompt into multiple shell commands. The simultaneous use of `--dangerously-skip-permissions` increases the potential impact by removing approval checks from the delegated agent as well. ### Attack Path 1. An attacker supplies programming requirements containing shell metacharacters, quotation marks, or command-substitution syntax. 2. The executing agent replaces the placeholder in the documented command with the attacker-controlled text. 3. The composed command is passed to a shell rather than to a process API using a fixed argument array. 4. The injected characters escape or alter the intended prompt argument. 5. The shell interprets attacker-selected text as additional syntax or commands. 6. Injected commands execute with the privileges and environment of the account running the Skill. Exploitation depends on the implementation following the documented string-interpolation pattern t ...[truncated 638 chars]
• Remediation: ## Remediation Suggestions 1. Do not build a shell command by concatenating or interpolating task text. 2. Invoke Claude Code with a process-execution API that accepts an argument array and does not invoke a shell. Pass the prompt as one discrete argument. 3. Prefer delivering long or untrusted requirements through standard input or a securely created input file. 4. If a shell is unavoidable, use a well-tested platform-specific escaping routine rather than manual quoting; argument-array execution should still be preferred. 5. Never use `eval`, nested shell evaluation, or command strings assembled from user-controlled content. 6. Add tests containing quotation marks, command substitutions, newlines, semicolons, pipes, redirection operators, and other shell metacharacters to verify they remain inert prompt data. 7. Remove `--dangerously-skip-permissions` so that a separate approval boundary remains available if prompt handling fails.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger description covers generic requests such as writing code, creating projects, fixing bugs, and implementing features, making activation extremely broad. When paired with permission-bypassing and operational behavior, this broad scope increases the chance that normal user requests will invoke a high-privilege automation path without clear user intent.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill tells the agent to use permission-skipping execution but provides no warning to the user about the safety implications of bypassing approval checks. This creates a hidden elevation of capability where system-changing actions may occur without informed consent or opportunity for review.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### 步骤 2: 调用 Claude Code 写代码
使用以下命令格式：
```bash
claude -p --dangerously-skip-permissions "你的具体要求"
```

关键参数：

• Confidence: 90% confidence
• Finding: The skill hard-codes delegation to an external model/provider via the `claude` CLI, introducing an external execution/dependency path into the workflow. While provider selection itself is not always unsafe, here it becomes risky because it is coupled with permission bypass and broad coding-task activation, increasing the blast radius of mis-executed or overreaching actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs use of `claude -p --dangerously-skip-permissions`, which disables normal approval gates for code-writing actions. In the context of a broadly triggered coding skill, this can cause unreviewed file modifications or command execution pathways that materially increase the chance of unsafe or unintended system changes.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The workflow expands beyond writing code into running servers, testing applications, and committing to Git, which are operational actions with side effects not clearly bounded by the skill's stated purpose. Because the trigger is broad, users invoking a coding helper may unknowingly activate actions that start processes, alter repositories, or persist changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow includes starting servers, testing running applications, and Git submission actions without disclosing that these steps can change system state, consume resources, expose services, or persist changes in version control. In a coding skill, these side effects are significant and should not occur silently.

Static analysis

No suspicious patterns detected.