Claude Anywhere

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:24 PM UTC
• Version: 1.6.2

Overview

This skill advertises remote control of Claude Code from chat apps, but it grants that control with disabled permission checks, weak operator scoping, and persistent scheduled execution.

Install only after reviewing this as a high-impact remote-control service. Run it under a dedicated unprivileged account, restrict bot access with explicit allowlists, remove --dangerously-skip-permissions, avoid broad CLAUDE_CWD or KNOWLEDGE_DIR settings, disable or tightly gate cron jobs, sanitize attachments, and avoid the curl-to-sudo install path.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: core.mjs:634

Finding

Remote Messages Execute Claude Code with Permission Checks Disabled

Content

View full analysis

["--add-dir", d]), ]; const proc = spawn(this.claudePath, args, { cwd: this.claudeCwd, env: { ...process.env }, stdio: ["pipe", "pipe", "pipe"], }); ``` ### Technical Analysis Messages originating from internet-facing chat platforms are passed directly to Claude Code while the `--dangerously-skip-permissions` option is enabled. This option suppresses Claude Code's normal approval boundary for filesystem, shell, and other sensitive tool operations. The child process also inherits the complete service environment and runs from a configurable working directory. Consequently, the process may have access to platform credentials, license keys, source code, SSH material, cloud credentials, and every file or command available to the operating-system account running the bridge. This exceeds minimum privilege even though remote file and command operations are advertised features. Such functionality should be restricted to an authorized workspace and a controlled tool policy rather than granting every remote prompt unrestricted access to the service account. ### Attack Path 1. An attacker obtains the ability to send a message to a confi ...[truncated 1215 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: bridge-telegram.mjs:232

Finding

No Application-Level Authorization for Remote Bot Operators

Content

View full analysis

{ const chatId = msg.chat.id; const userId = String(msg.from.id); const text = msg.text?.trim(); const msgId = String(msg.message_id); core.trackChatId(userId, chatId); if (!text || text.startsWith("/")) return; if (core.isProcessing(msgId)) return; // ... const pro = await core.isProMode(); if (pro) { await bot.sendMessage(chatId, "Thinking..."); const result = await core.runClaude(text, core.getSessionId(userId)); ``` QQ follows the same trust model: ```js async function handleMessage(userId, text, replyFn) { if (!text?.trim()) return; text = text.trim(); // ... const pro = await core.isProMode(); const command = core.parseCommand(text); // ... const sessionId = pro ? core.getSessionId(userId) : null; const result = await core.runClaude(text, sessionId); } ``` ### Technical Analysis Platform sender identifiers are used for quota accounting and session routing, but there is no application-level owner check, enrollment check, user allowlist, group allowlist, tenant allowlist, or role-based authorization decision before invoking Claude. The implementation assumes that platform-side bot visibility and configuration are sufficient security boundaries. That is unsafe for a service intentionally capable of reading files and executing commands on a host. A public bot, an incorrectly configured group bot, or an account added to an unintended tenant immediately exposes the local agent interface. Free-tier quotas do not constitute authorization and do not prevent a limited number of dangerous commands. ### Attack Path 1. The bot is made public, a ...[truncated 945 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: bridge-telegram.mjs:292

Finding

Free-Tier Agent Responses Are Forcibly Modified with Promotional Content

Content

View full analysis

" + "claudeanywhere.gumroad.com/l/claude-anywhere ($5.99/mo)", ``` The bridge appends this content to every successful free-tier result: ```js const fullReply = result.text + core.T.upgradeAd; for (const chunk of core.splitText(fullReply)) { await bot.sendMessage(chatId, chunk); } ``` Equivalent modification occurs in the other bridges: ```js const finalText = pro ? result.text : result.text + core.T.upgradeAd; ``` ### Technical Analysis The bridge alters successful agent output by appending unrelated commercial content. This is not merely a separate status or quota message; it is a deterministic post-processing step applied to ordinary task results. Because the output is changed after Claude generates it, users cannot reliably treat the returned content as the unmodified result of the requested operation. In automated or structured-output workflows, appended text may also invalidate JSON, scripts, configuration fragments, or other machine-readable content. ### Attack Path 1. A free-tier user submits an ordinary task. 2. Claude returns the requested result. 3. The bridge concatenates a fixed promotional message to that result. 4. The modified response is returned as if it were the task output. 5. If the output is consumed by another tool, the injected text may alter or break downstream behavior. ### Impact Assessment The behavior causes: - Persistent alteration of agent responses. - Loss of output integrity. - Possible corruption of structured or executable output. - Repeated redirection to commercial destinations. - Reduced ability to distinguish task ...[truncated 186 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:96

Finding

Installation Guidance Executes a Mutable Remote Script as Root

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: bridge-telegram.mjs:190

Finding

Untrusted Attachment Filenames Can Escape the Temporary Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: bridge-qq.mjs:256

Finding

QQ Attachment Downloads Permit Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: license-client.mjs:38

Finding

Configurable License Endpoint Receives License Secrets and Stable Identifiers

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (100)

Known Vulnerable Dependency: form-data==2.3.3 — 2 advisory(ies): CVE-2025-7783 (form-data uses unsafe random function in form-data for choosing boundary); CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Critical

• Category: Supply Chain
• Confidence: 91% confidence

Finding

form-data 2.3.3 is both outdated and flagged for unsafe boundary generation plus CRLF injection. As a transitive dependency of deprecated request, it increases the attack surface around file/message uploads, especially when remote users can influence filenames or uploaded content metadata.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 98)May include surrounding context.

如未安装 / If not installed：

bash

# Ubuntu / Debian
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt-get install -y nodejs

# macOS（需要先安装 Homebrew / requires Homebrew）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 184)May include surrounding context.

第 3 步：创建配置文件 / Step 3: Create config file

bash

cp .env.example .env

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-qq.mjs (reported line 13)May include surrounding context.

js

*   - /cron creation warns user about no push support
 *
 * WebSocket flow:
 *   1. Get access token via POST https://bots.qq.com/app/getAppAccessToken
 *   2. Get gateway URL via GET https://api.sgroup.qq.com/gateway
 *   3. Connect WebSocket, receive Hello (op=10), send Identify (op=2)
 *   4. Receive events (op=0), heartbeat (op=1), resume on disconnect

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-qq.mjs (reported line 97)May include surrounding context.

js

*   - /cron creation warns user about no push support
 *
 * WebSocket flow:
 *   1. Get access token via POST https://bots.qq.com/app/getAppAccessToken
 *   2. Get gateway URL via GET https://api.sgroup.qq.com/gateway
 *   3. Connect WebSocket, receive Hello (op=10), send Identify (op=2)
 *   4. Receive events (op=0), heartbeat (op=1), resume on disconnect

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-qq.mjs (reported line 100)May include surrounding context.

js

*   - /cron creation warns user about no push support
 *
 * WebSocket flow:
 *   1. Get access token via POST https://bots.qq.com/app/getAppAccessToken
 *   2. Get gateway URL via GET https://api.sgroup.qq.com/gateway
 *   3. Connect WebSocket, receive Hello (op=10), send Identify (op=2)
 *   4. Receive events (op=0), heartbeat (op=1), resume on disconnect

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-qq.mjs (reported line 305)May include surrounding context.

js

*   - /cron creation warns user about no push support
 *
 * WebSocket flow:
 *   1. Get access token via POST https://bots.qq.com/app/getAppAccessToken
 *   2. Get gateway URL via GET https://api.sgroup.qq.com/gateway
 *   3. Connect WebSocket, receive Hello (op=10), send Identify (op=2)
 *   4. Receive events (op=0), heartbeat (op=1), resume on disconnect

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code invokes the Claude CLI with --dangerously-skip-permissions, explicitly disabling permission safeguards for a system that can read/write files, manage code, and execute commands. Because user messages from chat platforms are passed into this agent workflow, an attacker can trigger high-risk local actions with reduced safety barriers, greatly increasing the chance of arbitrary file access or command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The subprocess is configured to skip permission checks and there is no user-facing disclosure, consent prompt, or compensating control around that behavior. In this skill's context, remote users can ask the agent to operate on local files and system resources, so silently bypassing safeguards materially increases the risk of unauthorized or destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Scheduled job execution runs Claude with --dangerously-skip-permissions on arbitrary persisted prompts, meaning remote users can create recurring or one-time tasks that later execute with reduced safety controls. Because this product explicitly supports reading/writing files, executing commands, and managing code, scheduled prompts can become unattended privileged actions with significant risk of file tampering, data theft, or system compromise.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · cron-manager.mjs (reported line 447)May include surrounding context.

js

if (this._scheduleOnce(job)) started++;
          else skipped++;
        } else {
          // Past one-time jobs: remove silently
          logger.info(`Removing past one-time job [${job.id.slice(0, 8)}] "${job.name}"`);
          skipped++;
        }

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 472)May include surrounding context.

html

</head>
<body>

<!-- NAV -->
<nav>
  <a href="#" class="nav-logo">
    <svg class="logo-svg" viewBox="0 0 32 32" fill="none" xmlns="http://www.w3.org/2000/svg">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 523)May include surrounding context.

html

</div>
</section>

<!-- FEATURES -->
<section id="features">
  <div class="section-inner">
    <div class="section-header">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 685)May include surrounding context.

html

</div>
    <div class="setup-grid">

      <!-- Telegram -->
      <div class="setup-card" id="setup-telegram">
        <div class="setup-card-header">
          <div class="setup-card-title">💬 Telegram</div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · index.html (reported line 753)May include surrounding context.

html

</div>
      </div>

      <!-- QQ -->
      <div class="setup-card" id="setup-qq">
        <div class="setup-card-header">
          <div class="setup-card-title">🐧 QQ</div>

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-qq.mjs (reported line 30)May include surrounding context.

js

npm install
echo ""
echo "Setup complete! Next steps:"
echo "1. cp .env.example .env"
echo "2. Edit .env with your credentials"
echo "3. (Optional) Set LICENSE_KEY for Pro mode"
echo ""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-qq.mjs (reported line 49)May include surrounding context.

js

npm install
echo ""
echo "Setup complete! Next steps:"
echo "1. cp .env.example .env"
echo "2. Edit .env with your credentials"
echo "3. (Optional) Set LICENSE_KEY for Pro mode"
echo ""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-telegram.mjs (reported line 19)May include surrounding context.

js

npm install
echo ""
echo "Setup complete! Next steps:"
echo "1. cp .env.example .env"
echo "2. Edit .env with your credentials"
echo "3. (Optional) Set LICENSE_KEY for Pro mode"
echo ""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-wecom.mjs (reported line 19)May include surrounding context.

js

npm install
echo ""
echo "Setup complete! Next steps:"
echo "1. cp .env.example .env"
echo "2. Edit .env with your credentials"
echo "3. (Optional) Set LICENSE_KEY for Pro mode"
echo ""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bridge-wecom.mjs (reported line 38)May include surrounding context.

js

npm install
echo ""
echo "Setup complete! Next steps:"
echo "1. cp .env.example .env"
echo "2. Edit .env with your credentials"
echo "3. (Optional) Set LICENSE_KEY for Pro mode"
echo ""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 7)May include surrounding context.

sh

npm install
echo ""
echo "Setup complete! Next steps:"
echo "1. cp .env.example .env"
echo "2. Edit .env with your credentials"
echo "3. (Optional) Set LICENSE_KEY for Pro mode"
echo ""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · start-all.mjs (reported line 12)May include surrounding context.

js

npm install
echo ""
echo "Setup complete! Next steps:"
echo "1. cp .env.example .env"
echo "2. Edit .env with your credentials"
echo "3. (Optional) Set LICENSE_KEY for Pro mode"
echo ""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · start-all.mjs (reported line 48)May include surrounding context.

js

npm install
echo ""
echo "Setup complete! Next steps:"
echo "1. cp .env.example .env"
echo "2. Edit .env with your credentials"
echo "3. (Optional) Set LICENSE_KEY for Pro mode"
echo ""

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

axios 1.13.6 is flagged with multiple advisories including SSRF/proxy-bypass and prototype-pollution-related issues. In this skill, HTTP-capable components are especially sensitive because the advertised functionality includes remote file access, command execution, and integration with messaging platforms, so a vulnerable HTTP client can expand attacker reach or leak credentials.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names/filenames. If this skill uploads files or relays user-controlled filenames from Telegram/QQ/WeCom, an attacker may be able to manipulate multipart requests in ways that confuse downstream services or alter request structure.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: core.mjs:649

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: cron-manager.mjs:117

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: bridge-qq.mjs:39

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: bridge-telegram.mjs:28

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: core.mjs:322

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: license-client.mjs:38

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: core.mjs:393