Security audit

Claude Code Direct

Security checks across malware telemetry and agentic risk

Overview

This plugin appears to do what it says, but it needs review because it lets chat agents drive Claude Code with file-editing and shell access while storing detailed session records.

Install only if you want OpenClaw agents or chat commands to control Claude Code with file-editing and shell authority. Use a dedicated workspace where possible, narrow allowedTools if you do not need Bash or writes, avoid putting secrets in prompts, review the .claude/settings.local.json hook changes, and periodically clear or protect the plugin's local data directory.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The top-level description says the skill can write, edit, fix, and refactor code, but it does not prominently warn that it may also run commands and directly modify the workspace. That can cause users or calling agents to invoke the skill without informed consent, increasing the risk of unintended code changes or command execution in sensitive environments.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instruction to return all cc tool output exactly as received forbids review, filtering, or redaction before disclosure. If Claude Code returns secrets, tokens, private source, filesystem data, or command output containing sensitive information, the skill would exfiltrate it directly to the user or upstream caller.

Session Persistence

Medium

Category: Rogue Agent
Content: - `message` (string, required) — The task or message for Claude Code - `workspace` (string, optional) — Workspace directory path. If omitted, uses the active workspace. - `model` (string, optional) — Model to use. Options: `sonnet`, `opus`, `haiku`, `sonnet[1m]`, `opusplan`. If omitted, uses configured default. - `continue_session` (boolean, optional) — If true, resume the previous session instead of starting fresh. Default: false. Use for: writing code, fixing bugs, refactoring, running commands, asking questions about a codebase.
Confidence: 82% confidence
Finding: Resuming previous sessions can unintentionally carry forward prior context, including sensitive code, credentials, instructions, or assumptions from earlier tasks. In a multi-step or multi-user environment, this increases the chance of context leakage, confused-deputy behavior, or actions based on stale state.

Session Persistence

Medium

Category: Rogue Agent
Content: - `message` (string, required) — The task description to plan for - `workspace` (string, optional) — Workspace directory path. If omitted, uses the active workspace. - `model` (string, optional) — Model to use. Options: `sonnet`, `opus`, `haiku`, `sonnet[1m]`, `opusplan`. If omitted, uses configured default. - `continue_session` (boolean, optional) — If true, resume the previous session instead of starting fresh. Default: false. Use for: complex or high-risk changes where you want to review before executing. After creating a plan, use `cc_execute` to proceed or `cc_reset` to discard.
Confidence: 82% confidence
Finding: The same session-resume behavior applies to planning flows, so a plan may inherit prior context or assumptions not visible in the current request. That can lead to sensitive data influencing later execution or a user unknowingly acting on stale plans tied to earlier conversations.

VirusTotal

64/64 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/core/claude-bridge.ts:211
Evidence: const child = spawn(cmd, args, {