Claude Code Task

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:00 AM UTC
• Version: 1.2.0

Overview

The skill’s coding-agent workflow is coherent, but it exposes project secrets and launches agents with unusually broad unchecked access.

Review carefully before installing. Avoid using this with real project .env files or production credentials, remove the permission-bypass launch mode, pin the installer version, and do not store arbitrary custom CLI commands in memory unless you fully trust the command and workspace.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:44

Finding

Claude Code Is Launched with Permission Controls Disabled

Content

View full analysis

"nvm use 20 && " Enter ``` The troubleshooting guide repeats the unsafe invocation: ```bash tmux send-keys -t "nvm use 20 && claude --dangerously-skip-permissions" Enter ``` ### Technical Analysis The Skill explicitly starts Claude Code with `--dangerously-skip-permissions`, bypassing its normal per-operation permission checks. The separate instruction to present a plan and wait for approval is only a prompt-level convention; it does not technically restrict the commands or resources available to the delegated agent after approval. A coding agent routinely processes repository content, issue descriptions, and task instructions that may be attacker-controlled. Disabling permission enforcement therefore removes an important security boundary against prompt injection, erroneous commands, and unauthorized access. ### Attack Path 1. A user invokes the Skill against a repository containing malicious instructions or supplies an attacker-controlled coding task. 2. The Skill creates a tmux session and launches Claude Code with `--dangerously-skip-permissions`. 3. The coding agent processes the untrusted repository content or task instructions. 4. Malicious instructions induce the agent to execute shell commands, read sensitive files, or modify resources outside the intended task. 5. Because permission checks were disabled, the operation can proceed without a separate authorization prompt. ### Impact Assessment The delegated agen ...[truncated 387 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:33

Finding

Project Environment Secrets Are Exposed Through Worktree Symlinks

Content

View full analysis

worktree add -b main # Symlink env files ln -sf /.env /.env ln -sf /.env.local /.env.local # if exists ``` The troubleshooting guide reinforces the behavior: ```bash ln -sf /.env /.env ``` ### Technical Analysis The Skill unconditionally instructs the host agent to expose the original project's `.env` files inside the delegated agent's worktree. Such files commonly contain API keys, access tokens, database credentials, private service URLs, and other secrets. A symbolic link does not create an isolated copy. Reads through the worktree resolve to the original secret file, and writes through the link may modify that original file. This undermines the claimed worktree isolation and grants every selected coding agent—including arbitrary custom CLI tools—access to secrets that may not be necessary for the coding task. The risk is amplified by launching Claude Code with permission checks disabled. ### Attack Path 1. The user starts a coding task through the Skill. 2. The Skill creates a worktree and links the original `.env` and, when present, `.env.local` into it. 3. A compromised, untrusted, or prompt-injected coding agent enumerates or reads those files. 4. The agent uses the credentials to access associated services, includes them in generated output, writes them into tracked files, or transmits them using any available network channel. 5. If the process has write access, it may also alter the original environment files through the symlinks. ### Impact Assessment An attacker may obtain every credential present in th ...[truncated 385 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:18

Finding

Persistent Custom Tool Values Can Be Interpolated into Shell Commands

Content

View full analysis

"Which coding agent should I use? (default: claude) > Options: claude, codex, opencode, codebuddy, or any CLI tool name" Then save the answer to memory: ``` memory: preferred_coding_agent = ``` ``` The persisted value is subsequently used as executable command text: ```bash | Tool | Command | |---|---| | `claude` | `claude --dangerously-skip-permissions` | | `codex` | `codex` | | `opencode` | `opencode` | | `codebuddy` | `codebuddy` (or check its CLI name) | | other | use the tool's interactive CLI command | tmux send-keys -t "nvm use 20 && " Enter ``` ### Technical Analysis The Skill permits “any CLI tool name,” stores the supplied value in persistent memory, and later constructs shell input containing the corresponding command. No allowlist, validation, canonicalization, or shell-safe argument construction is specified. Because `tmux send-keys` sends text to an interactive shell, shell metacharacters embedded in a custom tool command can change the command's structure. A malicious value can append additional commands, introduce substitutions, or redirect input and output. Persisting the value in memory means the unsafe command may be reused automatically in later sessions without asking the user again. Other placeholders, including task names, project paths, worktree paths, and branch names, are also shown in shell commands without a documented validation or escaping policy. ### Attack Path 1. An attacker influences the coding-agent preference or causes a user to select a malicious custom CLI command conta ...[truncated 871 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Installation Instructions Execute an Unpinned Mutable Package Release

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (15)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill silently symlinks .env and .env.local into the worktree, making secrets directly available to the spawned coding agent. Users are not warned that credentials or API keys will be exposed inside the task workspace, which is especially dangerous when the agent can inspect files and run commands autonomously.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Symlinking <project>/.env into the agent's worktree exposes secrets such as tokens, credentials, and internal endpoints to the coding agent and any commands it executes. In the context of a persistent tmux session and disabled permission checks, this substantially raises the risk of credential disclosure or misuse.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

git -C worktree add -b main

Symlink env files

ln -sf /.env /.env ln -sf /.env.local /.env.local # if exists

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Symlinking .env.local similarly exposes local developer secrets that are often even less controlled than shared env files. These may contain machine-specific credentials, test accounts, or private endpoints that an autonomous coding agent can read and potentially leak through logs, commits, or network actions.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Symlink env files

ln -sf /.env /.env ln -sf /.env.local /.env.local # if exists

text

## Step 2: Start tmux session with the chosen agent

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly launches Claude with --dangerously-skip-permissions, which disables an important safety boundary and gives the coding agent broad unchecked filesystem and command access. In this skill, that access is paired with symlinked environment files and a persistent tmux session, so the agent can read secrets or modify the repo before human review despite the stated plan-first workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description omits any warning that it launches Claude with disabled permission safeguards. That omission prevents informed consent and understates the risk of granting an interactive coding agent broad execution and file access within a live project workspace.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 19)May include surrounding context.

text

Either remove the existing worktree first, or use a different branch name:
```bash
git worktree remove /tmp/task-x
# then retry

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 51)May include surrounding context.

text

Either remove the existing worktree first, or use a different branch name:
```bash
git worktree remove /tmp/task-x
# then retry

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 23)May include surrounding context.

then retry

text

## .env not found in worktree

```bash
ln -sf <project>/.env <worktree-path>/.env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The command ln -sf <project>/.env <worktree-path>/.env directly makes sensitive environment secrets available inside another workspace used by coding agents. If that workspace is less trusted, logged, committed, or inspected by tools, credentials can be exposed or misused.

Content

Scanner excerpt · references/troubleshooting.md (reported line 26)May include surrounding context.

.env not found in worktree

bash

ln -sf <project>/.env <worktree-path>/.env

tmux session already exists

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command uses npx clawhub@latest, which is an unpinned package reference that will fetch and execute whatever code is currently published under that package name. In a security-sensitive context, this creates supply-chain risk: a compromised maintainer account, malicious new release, or dependency hijack could lead users to run attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation description is very broad (build, fix, refactor, or review code), which increases the chance this high-privilege orchestration skill is invoked in situations where a lower-risk workflow would suffice. Because the skill provisions worktrees, exposes env files, and may start agents with elevated autonomy, broad triggering materially expands exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document claims the agent will wait for user approval before touching files, but the chosen launch mode disables permission checks that would help enforce that promise. This creates a misleading safety model where users may trust the workflow while the underlying agent still has the capability to act without meaningful guardrails.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The troubleshooting guidance explicitly recommends running Claude Code with --dangerously-skip-permissions, which disables safety/permission checks rather than addressing the underlying issue. In a coding agent skill that operates on repositories and shells via tmux, this materially increases the chance of unauthorized file access or risky command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide recommends git worktree remove /tmp/task-x as a routine troubleshooting step without any warning to verify the path, preserve uncommitted work, or confirm the worktree is disposable. In an automation-oriented skill, normalizing destructive cleanup commands can lead to accidental data loss or removal of the wrong workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The troubleshooting step advises symlinking the main project's .env into another worktree without warning that this propagates secrets into an additional execution context. Because this skill runs coding agents in isolated worktrees, exposing production or developer credentials to those worktrees increases the blast radius of compromise or accidental leakage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.