claude-code-local

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

The skill is coherent but needs review because it prominently documents unrestricted local Claude Code execution and risky credential-environment troubleshooting.

Install only if you understand that this skill can cause an agent to run Claude Code locally with file, shell, and credential access. Prefer read-only or tightly scoped modes, avoid `--dangerously-skip-permissions` except in an isolated trusted workspace, do not move API keys into broadly inherited shell startup paths, and pin or verify the Claude Code CLI before global installation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:13
• Finding: Claude Code Permission Checks Can Be Completely Disabled## Vulnerability Details **File Location**: `SKILL.md:13` and `SKILL.md:38` **Vulnerability Type**: Unrestricted permission bypass **Risk Level**: High ### Vulnerable Code ```markdown | Full permissions | `cd <project> && claude --bare -p "<task>" --dangerously-skip-permissions --output-format stream-json --verbose --include-partial-messages --max-turns 30` | ``` ```markdown | 4 Full | bypass | `--dangerously-skip-permissions` | Trusted projects, batch ops | ``` ### Technical Analysis The documented `--dangerously-skip-permissions` option disables Claude Code's normal permission checks. This permits the delegated agent to use every capability available to the invoking operating-system account without interactive authorization. Although the documentation says that the mode is intended for trusted projects, it does not require human confirmation, isolation, credential removal, filesystem restrictions, or validation of repository content. Repository files can contain attacker-controlled instructions that influence an agent reviewing or modifying the project. Running against such content without permission enforcement violates least-privilege principles. ### Attack Path 1. An attacker places adversarial instructions or misleading task content in a repository processed by this Skill. 2. The orchestrator selects the prominently documented full-permission template. 3. Claude Code starts with `--dangerously-skip-permissions`. 4. The delegated agent encounters and follows the attacker-controlled repository instructions. 5. Commands execute without Claude Code requesting permission. 6. The commands can access, modify, or delete resources available to the invoking user and may read credentials present in the execution environment. ### Impact Assessment Exploitation grants the delegated process the effective privileges of the user who invoked Claude Code. Depending on that account and its environment, ...[truncated 368 chars]
• Remediation: ## Remediation Suggestions - Remove the permission-bypass command from the Quick Reference section. - Make read-only mode the default and grant only the tools required for each task. - Require explicit, informed human confirmation before any permission bypass. - If unrestricted operation is unavoidable, run it in an ephemeral container or virtual machine with: - No host credentials or sensitive environment variables. - A narrowly mounted project directory. - A nonprivileged operating-system account. - Restricted network access. - Resource and execution-time limits. - Inspect repositories for untrusted agent instructions before allowing write or shell capabilities. - Maintain an audit log of the selected permission mode, commands executed, and modified files.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/troubleshooting.md:6
• Finding: Troubleshooting Guidance Exposes Host Metadata and Encourages Persistent Shell Configuration Changes## Vulnerability Details **File Location**: `references/troubleshooting.md:6-13` and `references/troubleshooting.md:50-61` **Vulnerability Type**: Excessive environment reconnaissance and unsafe credential-loading guidance **Risk Level**: Medium ### Vulnerable Code ```bash whoami && echo "HOME=$HOME" && echo "SHELL=$SHELL" echo "PATH=$PATH" command -v claude && claude --version test -n "$ANTHROPIC_API_KEY" && echo "API_KEY=set" || echo "API_KEY=missing" test -n "$ANTHROPIC_AUTH_TOKEN" && echo "AUTH_TOKEN=set" || echo "AUTH_TOKEN=missing" command -v jq || echo "jq=missing" ``` ```markdown 1. Check `.bashrc` for interactive guard: ```bash grep -n "return" ~/.bashrc | head -3 ``` 2. If guard exists (`case $- in...` or `[ -z "$PS1" ]`), move API key exports above it 3. Alternative: use `bash -lc '...'` to force login shell ``` ### Technical Analysis The troubleshooting procedure collects the username, home directory, shell, full executable search path, installed tooling, and presence of authentication credentials. While it does not print credential values, this metadata may be included in agent transcripts, CI logs, or other diagnostic records. The guidance also recommends moving API-key exports above an interactive-shell guard in `.bashrc`. This is a persistent change to shell startup behavior and may cause secrets to be exported into a wider range of noninteractive processes than intended. It can consequently increase credential exposure if subprocesses, hooks, build scripts, or untrusted project commands inherit the environment. ### Attack Path 1. A Claude Code invocation reports an authentication or environment-loading failure. 2. The operator or delegated agent executes the complete diagnostic block. 3. Host identity, path configuration, tool locations, and credential-presence information are written to logs or agent-visible output. 4. The operator f ...[truncated 867 chars]
• Remediation: ## Remediation Suggestions - Replace the broad status block with error-specific checks. - Avoid printing the full `HOME`, `PATH`, username, or shell unless directly required. - Continue checking only whether credentials exist; never print their values. - Warn users not to copy diagnostic output into public issues without redaction. - Do not recommend moving API-key exports above interactive-shell guards. - Prefer a dedicated, permission-restricted environment file or the platform's secret manager. - Inject credentials only into the specific Claude Code process that needs them. - Require user review before changing `.bashrc` or any other persistent startup file. - Ensure untrusted repository commands and hooks do not inherit API credentials.

T08 · Insecure Dependencies

Warning

• Location: references/troubleshooting.md:30
• Finding: Unpinned Global Installation of Claude Code Creates Supply-Chain Exposure## Vulnerability Details **File Location**: `references/troubleshooting.md:30` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @anthropic-ai/claude-code ``` ### Technical Analysis The troubleshooting guide installs the latest package available under the expected Anthropic npm scope without pinning a reviewed version or requiring provenance and integrity verification. A global npm installation may execute package lifecycle scripts during installation and places an executable in the user's global command path. The package name itself is not evidence of a malicious dependency. The risk arises because the effective installed code can change after this Skill has been reviewed. This is especially significant because the resulting CLI is subsequently documented for use with local project access and, in some workflows, disabled permission checks. ### Attack Path 1. Claude Code is absent from the system. 2. The operator follows the troubleshooting instruction. 3. npm resolves the package to the latest published version and downloads its dependency graph. 4. Package lifecycle scripts execute with the privileges of the installing user, if present and permitted by npm. 5. A compromised upstream release or transitive dependency executes malicious code during installation or later CLI use. 6. The installed CLI receives access to local projects and potentially sensitive environment variables; use with permission bypass further increases the accessible scope. ### Impact Assessment A compromised dependency could execute arbitrary code with the invoking user's privileges. The potential scope includes theft of user-readable credentials, modification of project or user files, tampering with globally installed tools, and unauthorized network activity. No compromised package or active malicious payload was found in the audited files. This finding conce ...[truncated 47 chars]
• Remediation: ## Remediation Suggestions - Pin the package to a reviewed, explicitly approved version. - Use Anthropic's verified installation channel and validate publisher provenance. - Record and verify package integrity metadata where the deployment process supports it. - Review dependency and lifecycle-script changes before upgrading. - Prefer an isolated installation environment instead of a user-wide global installation. - Run installation and the resulting CLI as a nonprivileged user. - Separate credentials from installation processes and deny unnecessary network or filesystem access. - Establish a controlled upgrade process with testing and rollback support.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### Extract text_delta only (with jq)
```bash
claude --bare -p "..." --output-format stream-json | \
  jq -rj 'select(.type=="stream_event" and .event.delta.type?=="text_delta") | .event.delta.text'
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### Extract text_delta only (with jq)
```bash
claude --bare -p "..." --output-format stream-json | \
  jq -rj 'select(.type=="stream_event" and .event.delta.type?=="text_delta") | .event.delta.text'
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

### Extract text_delta only (with jq)
```bash
claude --bare -p "..." --output-format stream-json | \
  jq -rj 'select(.type=="stream_event" and .event.delta.type?=="text_delta") | .event.delta.text'
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents a full-permission mode using `--dangerously-skip-permissions` and labels it for 'trusted projects, batch ops' without an adjacent, explicit warning that the delegated agent may execute arbitrary commands and modify or damage the local system. In this skill’s context, the agent runs on the same machine as the orchestrator, so normalizing unsafe bypass mode materially increases the chance of destructive command execution, data loss, or secret exposure if the prompt, repository, or downstream agent behavior is compromised.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This markdown documentation presents core explanatory content in Chinese while the rest of the file is otherwise English, without offering a language choice or stating that the skill is region-specific. That can violate language/locale policy because it imposes a specific language on users without opt-in.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The troubleshooting commands print environment details including HOME, SHELL, PATH, and whether authentication-related variables are present. While the commands do not echo secret values directly, they expose system context and credential-state information without any warning or redaction guidance, which can leak useful reconnaissance data into logs, screenshots, shared terminals, or bug reports.

Session Persistence

Medium

• Category: Rogue Agent

Content

INVALID_REQUEST: SYSTEM_RUN_DENIED
```
- **Cause**: Some exec environments block multi-line heredocs
- **Fix**: Write script to `/tmp/` first, then execute

## Environment Loading

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The skill body is written in Chinese while the file does not indicate that language is optional or region-specific. This can violate language/locale policy when users are not given a choice or opt-in for the language used by the skill.

Static analysis

No suspicious patterns detected.