Claude Code Dev Workflow

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:50 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Claude Code integration guide, but it recommends always-approved coding-agent access and persistent/background sessions without enough scoping or safety controls.

Install only if you are comfortable letting Claude Code act in a dedicated, low-privilege workspace. Avoid production checkouts and broad credentials, prefer pinned plugin versions where possible, review diffs and logs, and change approval settings away from approve-all when interactive approval or tighter controls are available.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:45

Finding

Unrestricted Approval Mode Removes Agent Authorization Boundaries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-47
Vulnerability Type: Unrestricted agent permissions
Risk Level: High

bash

# 5. 设置权限（ACP 是非交互的，必须设）
openclaw config set plugins.entries.acpx.config.permissionMode approve-all

Technical Analysis

The documented configuration sets the ACP plugin's permission mode to approve-all and presents this setting as mandatory for non-interactive operation. This eliminates per-operation authorization for an autonomous coding agent that may be able to read and modify files, execute commands, access environment variables, and invoke development tools.

The absence of an approval boundary means that malicious instructions in an untrusted repository, prompt injection delivered through a bound conversation, or an incorrect agent decision can result in immediate tool execution. The effective privileges are those of the operating-system account running the OpenClaw gateway or Claude Code process.

Attack Path

1. An operator enables ACP using the documented approve-all configuration.
2. The operator binds Claude Code to a repository or conversation.
3. An attacker places malicious instructions in repository content, contributes hostile project documentation, or sends prompt-injection content through the bound conversation.
4. Claude Code interprets the content as instructions and requests a sensitive tool operation, such as reading credentials, changing source files, or executing a shell command.
5. The approve-all policy authorizes the operation without human confirmation.
6. The operation executes with the permissions of the account hosting the agent.

Impact Assessment

Successful exploitation can permit unauthorized command execution, source-code or configuration modification, access to credentials available in files or environment variables, and destructive actions within the host account's permission scope. If the gateway runs under a priv ...[truncated 207 chars]

Remediation

View remediation

Remediation Suggestions

• Replace approve-all with an interactive, deny-by-default, or least-privilege permission mode.
• Require explicit authorization for shell execution, writes outside the selected workspace, credential access, network operations, and destructive commands.
• Restrict the agent to a dedicated workspace and run it as an unprivileged operating-system account.
• Use an isolated container or sandbox for non-interactive workflows, with a read-only base filesystem and no access to host credentials.
• Apply command and path allowlists rather than granting unrestricted tool access.
• Provide only short-lived, task-specific credentials and prevent unnecessary environment variables from reaching the agent process.
• Treat repository content and bound-chat messages as untrusted input, and require confirmation before acting on instructions discovered in those sources.
• Record and review tool calls, filesystem changes, and command execution for auditability.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Plugin Installation Creates Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35-38
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash

# 3. 安装 OpenClaw acpx 插件
openclaw plugins install acpx
openclaw config set plugins.entries.acpx.enabled true

Technical Analysis

The installation command identifies the acpx plugin only by a mutable short name. It does not specify an exact reviewed version, immutable artifact digest, trusted registry, publisher identity, checksum, or signature. Consequently, the component installed at deployment time may differ from the component that was originally reviewed.

Plugin code can operate within the OpenClaw runtime and may have access to agent requests, configuration, credentials, files, or command-execution facilities. A compromised publisher account, registry compromise, malicious package replacement, or unsafe dependency update could therefore introduce executable attacker-controlled behavior.

Attack Path

1. An attacker compromises the package publisher, plugin registry, name-resolution mechanism, or a future dependency release.
2. The mutable acpx name resolves to an altered or malicious plugin artifact.
3. An operator follows the guide and runs openclaw plugins install acpx.
4. The subsequent configuration command enables the installed plugin.
5. The malicious component executes within the plugin's granted runtime context and accesses capabilities or data available to that context.

Impact Assessment

The obtainable privileges depend on the OpenClaw plugin runtime and the operating-system account used to install and run it. Potential impact includes interception or alteration of agent tasks, unauthorized file access, credential exposure, command execution, and manipulation of coding sessions. Combined with unrestricted approval mode, a compromised plugin could potentially exercise broad host-level capabilities without requiring furth ...[truncated 21 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to an exact reviewed version or, preferably, an immutable artifact digest.
• Specify and enforce a trusted registry and verified publisher identity.
• Validate cryptographic signatures or published checksums before enabling the plugin.
• Use a lockfile or equivalent deployment manifest to ensure reproducible installations.
• Review plugin source code and release changes before upgrading.
• Disable automatic updates in security-sensitive environments and test updates in an isolated staging environment.
• Run plugins with minimal filesystem, network, credential, and command-execution permissions.
• Maintain an approved dependency inventory and monitor the plugin and its transitive dependencies for compromise or known vulnerabilities.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly tells users to set ACP permission mode to "approve-all" for a non-interactive integration, which grants the external coding agent broad authority to execute actions without per-action confirmation. In the context of a code-writing agent that can read, modify files, and run commands, this materially increases the risk of destructive changes, secret exposure, or unintended command execution if prompts, upstream inputs, or the toolchain are compromised.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

bash

# -p 参数 = print mode，单次输出后退出
claude -p "Analyze this code for security issues" --output-format json

# 限制预算（防止跑飞）
claude -p --max-budget-usd 5.00 "Run tests and fix failures"

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

claude -p "Analyze this code for security issues" --output-format json

限制预算（防止跑飞）

claude -p --max-budget-usd 5.00 "Run tests and fix failures"

text

---

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

3. 设预算上限：防止 Claude Code 陷入死循环

   bash

   claude -p --max-budget-usd 2.00 "Your task"
   

4. 用 compact 命令：长会话时主动压缩上下文

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The PTY guidance instructs users to launch Claude Code through exec/background flows but does not warn that the agent may execute shell commands, alter repository contents, or act on untrusted project state. Because this skill is specifically for automated coding and debugging, omitting that warning can cause users to run a powerful agent in a live workspace without understanding the operational and security consequences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.