claude-code-noninteractive-in-node

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent remote Claude Code helper, but it normalizes very broad remote execution permissions and unsafe credential handling without enough guardrails.

Install only if you understand and control the remote Node. Prefer read-only or narrowly allowlisted permissions, avoid `--dangerously-skip-permissions` except in trusted disposable environments, do not paste untrusted task text into the provided shell templates, and use a secret manager or scoped environment injection instead of storing API keys in `.bashrc` or printing any part of them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:16
• Finding: Shell Command Injection Through Unescaped Template Placeholders<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-19` and `SKILL.md:54` **Vulnerability Type**: Shell command injection caused by unsafe string interpolation **Risk Level**: High ### Vulnerable Code ```bash | Short task | `bash -lc 'cd <project> && claude --bare -p "<task>" --max-turns 10'` | | Long streaming task | `bash -lc 'cd <project> && claude --bare -p "<task>" --output-format stream-json --verbose --include-partial-messages --max-turns 30'` | | Full permissions | `bash -lc 'cd <project> && claude --bare -p "<task>" --dangerously-skip-permissions --output-format stream-json --verbose --include-partial-messages --max-turns 30'` | | Read-only analysis | `bash -lc 'cd <project> && claude --bare -p "<task>" --permission-mode plan --allowedTools "Read,Glob,Grep,LSP" --max-turns 10'` | ``` ```json { "command": "bash -lc 'cd <project> && claude --bare -p \"<task>\" --max-turns 10'", "host": "node", "node": "<your-node-id>", "background": true, "timeout": 600 } ``` ### Technical Analysis The documented templates insert `<project>` and `<task>` directly into a command interpreted by `bash -lc`. The project path is not quoted, while the task is placed inside nested shell and JSON quotation contexts without a defined escaping mechanism. If either value originates from an untrusted or insufficiently validated source, shell metacharacters, quote characters, command substitutions, or separators can escape the intended argument context. The shell then interprets the injected content as additional commands on the remote Node. Nested quoting does not provide a security boundary. In particular, inserting a double quote into the task can terminate the intended prompt argument, while an unquoted project value can directly introduce shell operators. ### Attack Path 1. An attacker influences the project path or delegated task supplied to the documented command template. 2. The attacker includes shell syntax that escapes the intended `cd` p ...[truncated 1043 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not construct shell commands through direct interpolation of project paths or task text. - Prefer a structured process-execution API that accepts an executable and argument array without invoking a shell. - If `bash -lc` is unavoidable, pass dynamic values as positional parameters rather than embedding them in the command: ```bash bash -lc 'cd -- "$1" && exec claude --bare -p "$2" --max-turns 10' bash "$project" "$task" ``` - Ensure the process API passes `"$project"` and `"$task"` as separate arguments rather than concatenating them into one command string. - Canonicalize the project path and require it to remain beneath an explicitly approved root directory. - Reject null bytes and other invalid path input, but do not rely on character denylisting as the primary shell-injection defense. - Keep the default agent permission set read-only or explicitly allowlisted. - Run remote agents in isolated, disposable environments with restricted filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:72
• Finding: Insecure API Credential Storage and Diagnostic Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:72-73` and `references/troubleshooting.md:16` **Vulnerability Type**: Plaintext secret persistence and credential disclosure through command output **Risk Level**: Medium ### Vulnerable Code ```bash # In ~/.bashrc, BEFORE the interactive guard: export ANTHROPIC_API_KEY=sk-... ``` ```bash bash -lc 'echo $ANTHROPIC_API_KEY' | head -c 10 ``` ### Technical Analysis The Skill recommends storing an API key as plaintext in `.bashrc` before the interactive-shell guard. This causes the secret to be loaded into every applicable non-interactive login shell, broadening the set of subprocesses that inherit it. The troubleshooting command also prints the first ten characters of the credential. Even partial secret material should not be emitted into terminal output, remote execution results, automation logs, or observability systems. Depending on the provider's key format, this output can expose a recognizable key prefix and part of the secret value. Shell configuration files may also be copied into backups, included in diagnostic bundles, exposed through permissive file permissions, or read by another process operating under the same account. ### Attack Path 1. A user follows the Skill instructions and stores the API key in `~/.bashrc`. 2. Non-interactive commands executed under that account inherit the credential. 3. An untrusted or compromised process reads the environment, shell configuration, or a backup of the configuration. 4. Alternatively, an operator runs the documented diagnostic command. 5. Part of the API key is written to remote command output and may be retained in logs or monitoring records. 6. An attacker with access to the relevant process environment, configuration file, backup, or logs obtains sensitive credential material. ### Impact Assessment Exposure of the complete API key could permit unauthorized use of the associated API account, subject to the key's configured permissions ...[truncated 542 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store the API key in a dedicated secret manager or the Node platform's protected credential facility. - Inject the credential only into the specific Claude process that requires it. - Do not place long-lived plaintext credentials in `.bashrc`, repository files, command-line arguments, or general-purpose shell startup files. - Replace the disclosure-prone diagnostic with a presence check that emits no credential characters: ```bash bash -lc 'if [ -n "${ANTHROPIC_API_KEY:-}" ]; then echo "ANTHROPIC_API_KEY is configured"; else echo "ANTHROPIC_API_KEY is not configured"; fi' ``` - Restrict credential scope and privileges to the minimum required. - Use short-lived credentials where supported. - Ensure command output and diagnostic logs are access-controlled and subject to secret redaction. - Rotate any real key that has been printed, logged, or stored in an insecure configuration. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:18
• Finding: Remote Agent Permission Checks Can Be Completely Bypassed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18` and `references/permissions.md:11-12` **Vulnerability Type**: Excessive permissions and explicit bypass of agent safety controls **Risk Level**: High ### Vulnerable Code ```bash | Full permissions | `bash -lc 'cd <project> && claude --bare -p "<task>" --dangerously-skip-permissions --output-format stream-json --verbose --include-partial-messages --max-turns 30'` | ``` ```markdown | bypassPermissions | `--permission-mode bypassPermissions` | ✅ | ✅ | ✅ | ✅ | ✅ | | dangerously-skip | `--dangerously-skip-permissions` | ✅ | ✅ | ✅ | ✅ | ✅ | ``` The documented permission table grants file read, file write, shell, Git, and network capabilities in both unrestricted modes. ### Technical Analysis The Skill provides a standard workflow that invokes Claude Code with `--dangerously-skip-permissions`. The associated documentation confirms that this mode permits unrestricted file writes, shell execution, Git operations, and network access. This configuration removes approval and least-privilege boundaries that would otherwise constrain delegated operations. A coding prompt may contain untrusted repository content, issue text, generated instructions, or other attacker-controlled material. If such content influences the agent, the permission bypass gives the resulting behavior direct access to high-impact tools without an intervening authorization decision. The issue is especially significant because execution occurs on a remote Node that may contain credentials, multiple projects, Git identities, or access to internal network resources. ### Attack Path 1. An operator selects the documented full-permission command for a remote coding task. 2. The delegated task or target repository contains malicious, misleading, or otherwise unsafe instructions. 3. Claude Code processes that content while permission checks are disabled. 4. The agent invokes file-write, shell, Git, or network operations without requir ...[truncated 972 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `--dangerously-skip-permissions` and `--permission-mode bypassPermissions` from recommended command templates. - Default to `--permission-mode plan` or an explicit minimal tool allowlist. - Separate workflows by capability and grant only the tools required for the current task. - Require interactive or policy-based approval for shell commands, writes outside the project, Git pushes, and network operations. - Restrict execution to a canonicalized project directory. - Run each delegated task in a disposable container, virtual machine, or dedicated low-privilege account. - Mount unrelated directories and credentials as inaccessible. - Disable network access by default and allow only explicitly required destinations. - Use temporary, narrowly scoped credentials instead of inheriting the Node account's general environment. - Record and review privileged operations, and require confirmation before destructive or externally visible actions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents use of `--dangerously-skip-permissions` for remote execution but does not include a clear warning that this disables safety controls and may allow unrestricted file changes or command execution on the remote node. In a remote agent skill, normalizing this flag without guardrails materially increases the chance of unsafe delegation, privilege misuse, or destructive actions on the target machine.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Node Security Workarounds

- Multi-line heredocs → Write script to `/tmp/` first
- Inline Python → Same, use script file
- Write operations → Backup before modifying: `cp f f.bak.$(date +%F)`

• Confidence: 83% confidence
• Finding: The recommendation to write helper scripts to `/tmp/` introduces session-persistence and insecure temporary-file risks on multi-user systems, especially if filenames are predictable or permissions are not controlled. Temporary scripts may be read, replaced, or reused by other processes or users, and can leave sensitive task content or executable artifacts behind on the remote node.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill tells users to place `ANTHROPIC_API_KEY` directly in `~/.bashrc` without warning about credential exposure, shell history leakage, file-permission issues, or the broader implications of storing long-lived secrets in startup files. This can lead to accidental disclosure to other local users, backup systems, dotfile sync tools, or unrelated shell sessions on the remote machine.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly presents permission modes that enable file writes, shell, git, and network access, including highly privileged modes like bypassPermissions and dangerously-skip, but it does not warn that these settings can allow arbitrary command execution, repository modification, or outbound data access. In the context of a remote coding agent skill, this omission increases the chance that users enable unsafe modes without understanding the trust boundary or the consequences of delegating broad authority to a remote agent.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The example allowedTools configurations include Bash, Edit, and Write without any adjacent warning that Bash can execute system commands and that Edit/Write can alter the filesystem. Because this skill is specifically for remote non-interactive coding on another machine, these examples can normalize granting powerful capabilities to an agent in a context where misuse could affect a remote host and its repositories.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The troubleshooting guide suggests printing the first 10 characters of the ANTHROPIC_API_KEY to verify environment loading. Even partial credential disclosure is sensitive because it can be captured in terminal history, logs, screenshots, or remote session recordings, and normalizes unsafe secret-handling practices in a remote multi-machine workflow.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The skill presents its operational description and key usage table in Chinese, which can impose a language constraint on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Static analysis

No suspicious patterns detected.