FlowForge — Autonomous AI Coding Pipeline (Spec → Plan → Code → QA)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:24 AM UTC
• Version: 1.1.0

Overview

FlowForge has a coherent coding-automation purpose, but it disables permission checks, runs generated commands, sources executable workspace config, and persists copied account credentials.

Install only if you are comfortable with an autonomous agent modifying repositories and running commands with Claude Code permission checks disabled. Treat the copied Claude credential files as sensitive bearer credentials, restrict their permissions, avoid using this on untrusted GitHub issues or repositories, and prefer running it inside an isolated disposable environment without personal credentials mounted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/init_forge.sh:18

Finding

Arbitrary Command Execution Through Sourced Workspace Configuration

Content

View full analysis

"$WORKSPACE/forge.env" << ENV REPO_PATH="$REPO" WORKSPACE="$WORKSPACE" TIMESTAMP="$TIMESTAMP" ENV ``` `scripts/run_forge.sh:16`: ```bash source "$WORKSPACE/forge.env" ``` ### Technical Analysis The repository path is supplied by the user through the second argument to `init_forge.sh`. It is inserted directly into `forge.env` between double quotes without shell escaping. The resulting file is later loaded with Bash's `source` command. A sourced file is executable shell code, not a passive configuration format. A repository argument containing a double quote, command substitution, newline, or additional shell statement can terminate the generated assignment and inject commands. The runner also accepts an arbitrary workspace directory and sources its `forge.env` without checking that the workspace was created by FlowForge, is owned by the current user, has safe permissions, or resides below the expected `$HOME/.forge` directory. ### Attack Path 1. An attacker convinces a user or orchestration agent to initialize a task with a crafted repository path, for example a value containing shell syntax after an embedded quote. 2. `init_forge.sh` writes that value verbatim into `forge.env`. 3. The user runs `run_forge.sh` for the generated workspace. 4. `run_forge.sh` executes `source "$WORKSPACE/forge.env"`. 5. Bash interprets the injected content as commands and executes it with the privileges of the user running FlowForge. An alternative path is to provide a pre-created workspace containing a malicious `forge.env` and invoke `run_forge.sh` directly on that workspace. ### Impact Assessment Successful exploitation provides arbitrary command execution with the invoking user's priv ...[truncated 349 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: scripts/run_forge.sh:142

Finding

Untrusted Task Content Can Be Converted Into Executable Verification Commands

Content

View full analysis

/dev/null | head -30) Write spec.md to stdout. Output ONLY the spec, no commentary." run_claude "Spec generation" "$SPEC_PROMPT" "$WORKSPACE/spec.md" PLAN_PROMPT="$(cat "$SKILL_DIR/references/planner-prompt.md") ## Spec $(cat "$WORKSPACE/spec.md") ## Repo structure $(find "$REPO_PATH" -type f | grep -v '.git\|node_modules\|_build\|deps' | head -60) Output ONLY valid JSON for implementation_plan.json. No commentary." run_claude "Implementation planning" "$PLAN_PROMPT" "$WORKSPACE/implementation_plan.json" CODE_PROMPT="$(cat "$SKILL_DIR/references/coder-prompt.md") ## Implementation Plan $(cat "$WORKSPACE/implementation_plan.json") ## Repository path $REPO_PATH ``` `references/planner-prompt.md:69-80`: ```markdown ## Subtask Rules - One service per subtask - Max 2-3 files per subtask - Every subtask needs a verification command that proves it works - Phase dependencies must be respected (phase 2 can't start until phase 1 done) ## Valid Verification Types - `command` — shell command with expected output string - `api` — HTTP request with expected status code - `e2e` — multi-step flow verification - `manual` — human review required - `none` — no verification needed ``` `references/coder-prompt.md:65-73`: ```markdown ## Verification Run the exact command in the subtask's `verification.command`. - **Pass** (exit 0, expected output found) → mark `completed`, move on immediately - **Fail** → apply Tier 1 retry logic - **Transient error** (concurrency/race) → apply Tier 2 retry logic - **Rate limit** → apply Ti ...[truncated 2227 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/run_forge.sh:94

Finding

Claude Code Permission Controls Are Explicitly Disabled

Content

View full analysis

/dev/null 2>&1; then ``` `scripts/run_forge.sh:72`: ```bash if claude --dangerously-skip-permissions --print "ping" > /dev/null 2>&1; then ``` `scripts/run_forge.sh:94`: ```bash if claude --dangerously-skip-permissions --print "$PROMPT" > "$OUTPUT" 2>"$ERR_TMP"; then ``` ### Technical Analysis All substantive FlowForge prompts are executed with Claude Code's `--dangerously-skip-permissions` option. This option suppresses the normal permission-confirmation boundary around tool use. The bypass is particularly unsafe because the prompts include untrusted task text, generated plans, repository content, and generated verification commands. A successful prompt injection, malicious repository instruction, or model planning error can therefore result in tool execution without an interactive authorization checkpoint. The same option is unnecessarily used for lightweight authentication and rate-limit probes. ### Attack Path 1. Malicious or misleading content enters through a task, generated plan, or repository file. 2. Claude interprets the content as an instruction to perform a filesystem or shell operation. 3. FlowForge invokes Claude Code with permission checks disabled. 4. The operation proceeds without requesting user approval. 5. The operation runs with whatever filesystem, process, credential, and network access the FlowForge user has. ### Impact Assessment This design breaks least-privilege expectations and increases the impact of every prompt-injection or planning flaw in the pipeline. Depending on host configuration, the agent may be able to: - Write outside the intended repository. - Read user-owned cred ...[truncated 303 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/rotate_account.sh:25

Finding

Credential Rotation Uses Unvalidated Account Names and Does Not Enforce Secure File Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (22)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The README directly references copying ~/.claude/.credentials.json into a new file, which is a concrete credential-handling pattern associated with credential access and reuse. Because these files likely contain active authentication state, duplicating them creates additional theft targets and may enable unauthorized use of paid accounts or access to associated workspaces.

Content

Scanner excerpt · README.md (reported line 158)May include surrounding context.

md

# For each Claude Max account, authenticate and save credentials:
claude auth login   # sign in with account 1
cp ~/.claude/.credentials.json ~/.claude/accounts/[e-mail]

claude auth login   # sign in with account 2
cp ~/.claude/.credentials.json ~/.claude/accounts/[e-mail]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This second example repeats the same insecure pattern for another account, reinforcing a process that scales the number of exposed authentication artifacts with each additional subscription. In the context of an automation pipeline designed to rotate among accounts, that materially increases the blast radius of any local compromise.

Content

Scanner excerpt · README.md (reported line 161)May include surrounding context.

cp ~/.claude/.credentials.json ~/.claude/accounts/[e-mail]

claude auth login # sign in with account 2 cp ~/.claude/.credentials.json ~/.claude/accounts/[e-mail]

text

### 3. Run a task

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The invocation language is extremely broad (e.g., 'starting any new feature', 'plan and build', 'auto-implement', and routing 'ALL heavy work' automatically), which increases the chance the skill will trigger on ordinary development requests rather than an explicit, informed opt-in. In context, that broad matching is more dangerous because the skill immediately leads to autonomous shell-script execution and code modification behavior, so accidental invocation could cause unintended changes to files, repositories, or downstream systems.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/rotate_account.sh (reported line 15)May include surrounding context.

sh

# Save credentials for each account first:
#   claude auth login   # log in as account 1
#   mkdir -p ~/.claude/accounts
#   cp ~/.claude/.credentials.json ~/.claude/accounts/[e-mail]
#   # repeat for each account

ACCOUNTS_FILE="$HOME/.flowforge/accounts.txt"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/rotate_account.sh (reported line 59)May include surrounding context.

sh

# Save credentials for each account first:
#   claude auth login   # log in as account 1
#   mkdir -p ~/.claude/accounts
#   cp ~/.claude/.credentials.json ~/.claude/accounts/[e-mail]
#   # repeat for each account

ACCOUNTS_FILE="$HOME/.flowforge/accounts.txt"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The script switches identities by copying stored credential JSON files into the live Claude credentials path. This creates a local credential stockpile and directly manipulates authentication material, increasing the risk of account compromise if the account store is read, modified, or replaced by another local user or malware.

Content

Scanner excerpt · scripts/rotate_account.sh (reported line 54)May include surrounding context.

sh

CREDS_DIR="$HOME/.claude/accounts"
if [[ -f "$CREDS_DIR/$NEXT.json" ]]; then
  cp "$CREDS_DIR/$NEXT.json" "$HOME/.claude/.credentials.json"
  echo "✅ Switched to $NEXT"
else
  echo "⚠️  No saved credentials for $NEXT"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script unconditionally sources $WORKSPACE/forge.env, which executes shell code from a workspace-controlled file in the current process. If an attacker can influence the workspace contents, they can run arbitrary commands immediately when the script starts, before any later safeguards or logic execute.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script invokes claude with --dangerously-skip-permissions during the rate-limit probe, disabling an important safety barrier while processing prompts built from workspace-controlled files and repository content. In this skill context, the model is later instructed to modify code and interact with the repo, so bypassing permission checks materially increases the chance of unsafe file or command actions if malicious content is present.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/run_forge.sh (reported line 105)May include surrounding context.

sh

# ── Tier 3: Rate limit — don't count, rotate + wait ──────────────────
    if is_rate_limit "$ERR_TMP" || is_rate_limit "$LOG"; then
      wait_for_rate_limit || { log "❌ $STEP aborted: rate limit unrecoverable"; rm -f "$ERR_TMP"; exit 1; }
      log "  ↳ Resuming $STEP (rate limit cleared, logic attempt $LOGIC_ATTEMPT/$MAX_STEP_RETRIES)"
      continue
    fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/run_forge.sh (reported line 112)May include surrounding context.

sh

# ── Tier 3: Rate limit — don't count, rotate + wait ──────────────────
    if is_rate_limit "$ERR_TMP" || is_rate_limit "$LOG"; then
      wait_for_rate_limit || { log "❌ $STEP aborted: rate limit unrecoverable"; rm -f "$ERR_TMP"; exit 1; }
      log "  ↳ Resuming $STEP (rate limit cleared, logic attempt $LOGIC_ATTEMPT/$MAX_STEP_RETRIES)"
      continue
    fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

md

│  For each subtask:                    │
  │  ┌──────────────────────────────┐     │
  │  │ Read pattern files           │     │
  │  │ Write code changes           │     │
  │  │ Run verification command     │──┐  │
  │  │ Pass? → mark complete, next  │  │  │
  │  │ Fail? → fix, retry (3x max)  │◄─┘  │

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly instructs users to store Claude account credentials in per-account JSON files under ~/.claude/accounts, creating additional long-lived copies of active authentication material on disk. Even though this is documentation rather than executable code, normalizing plaintext-style credential duplication increases the chance of credential theft via local compromise, backups, accidental sharing, or weak filesystem permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These setup steps tell users to duplicate live Claude authentication credentials into multiple local files for account rotation, but provide no warning about the security consequences of proliferating secrets. This increases exposure surface substantially because each copied file becomes a reusable session artifact that may be harvested by malware, leaked through backups, or committed accidentally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Creating a dedicated ~/.claude/accounts directory for retained account files supports persistent storage of authentication artifacts across sessions. In this skill's context, the persistence is more dangerous because the whole feature depends on reusing multiple stored credentials automatically, making compromise of the local machine significantly more valuable to an attacker.

Content

Scanner excerpt · README.md (reported line 154)May include surrounding context.

2. Save your Claude Code accounts

bash

mkdir -p ~/.claude/accounts

# For each Claude Max account, authenticate and save credentials:
claude auth login   # sign in with account 1

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to run local shell scripts that create directories, write task artifacts, and execute an autonomous coding pipeline, but it does not require an upfront safety notice or explicit confirmation that code and files may be changed. This is dangerous because it normalizes immediate execution of file-writing and code-generating actions, increasing the risk of unintended repository modifications, unsafe command execution, or user surprise about side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs users to store per-account credential material in local JSON files for account rotation without any warning about secrets handling, file permissions, or secure storage. In context, this is risky because the skill is designed for automation and multi-account operation, making it more likely that sensitive credentials are persisted insecurely, exposed to other local processes, or accidentally committed or copied.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/planner-prompt.md (reported line 80)May include surrounding context.

md

- `api` — HTTP request with expected status code
- `e2e` — multi-step flow verification
- `manual` — human review required
- `none` — no verification needed

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The documented workflow persists multiple session credential files under ~/.claude/accounts for later reuse. Persisting active session material across accounts expands the attack surface by concentrating valid tokens in one location and making lateral account switching trivial for anyone who gains local access.

Content

Scanner excerpt · scripts/rotate_account.sh (reported line 14)May include surrounding context.

sh

#
# Save credentials for each account first:
#   claude auth login   # log in as account 1
#   mkdir -p ~/.claude/accounts
#   cp ~/.claude/.credentials.json ~/.claude/accounts/[e-mail]
#   # repeat for each account

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-of-file documentation says the script is used as run_forge.sh <workspace_path> [--rubric], implying a valid directory is sufficient. In practice, the script also requires forge.env inside that workspace and immediately sources it, which can execute shell code and is a materially stronger prerequisite than the comment suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script writes outputs such as spec.md, implementation_plan.json, implementation_plan_done.json, qa_report.md, and rubric_report.md into the provided workspace. These writes are core behavior, but the file does not include any user-facing warning or disclosure beyond a terse usage line that the script will create and overwrite artifacts in the workspace.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The inline comment says the script will perform a 'lightweight probe' to see whether rate limiting cleared. The actual command runs claude --dangerously-skip-permissions --print "ping", which is not just a neutral health check in documentation terms because it explicitly bypasses permission protections.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function is documented as waiting for re-authentication, suggesting a straightforward auth-status poll. The implementation checks recovery by repeatedly invoking claude --dangerously-skip-permissions --print "ping", which adds a behavior not reflected in the comment and weakens the stated intent of a simple auth wait loop.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.