T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:228- Finding
User-Controlled Session Name Interpolated into Executable Python and Shell Syntax
- Content
View full analysis
- Remediation
View remediation
Security audit
Publish Session Name Sync
Security checks for vulnerabilities and agentic risk
Overview
The skill has a real session-name syncing purpose, but its instructions include unsafe local command execution patterns and broad daemon/state changes that require careful review before use.
Install only if you understand that this skill may edit Claude Code and cc-connect session files, restart cc-connect, and affect Feishu message handling. Avoid using arbitrary or untrusted session names with the documented commands, and prefer a safer version that passes names as data, verifies daemon PIDs, backs up state files, and asks explicitly before restart or past_id_tracking changes.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:394- Finding
Overbroad Process Termination and Unverified Lock-File Deletion
- Content
View full analysis
/dev/null; sleep 1; kill -9 $(pgrep -f 'cc-connect') 2>/dev/null; rm -f ~/.cc-connect/.config.toml.lock; sleep 1 # ... make changes to JSON file (include past_id_tracking=False in the same write) ... # Restart daemon nohup cc-connect --force > /tmp/cc-connect.log 2>&1 & disown; sleep 3 ``` ### Technical Analysis `pgrep -f 'cc-connect'` searches complete process command lines rather than verifying the executable identity of the intended daemon. It can consequently select unrelated processes whose arguments or paths happen to contain `cc-connect`. The second command sends `SIGKILL` after a fixed one-second delay without verifying whether graceful shutdown is still in progress. Forced termination can interrupt state persistence or other critical operations. The lock file is then removed unconditionally. There is no verification that the lock belongs to the terminated process, that the process has actually exited, or that another legitimate instance has not acquired the lock. Starting the daemon with `--force` compounds the concurrency risk by potentially bypassing normal instance checks. The fixed `/tmp/cc-connect.log` path is also used without validating its existing file type or ownership. In environments where another local user or process can prepare that path, redirection may overwrite an unintended target through a malicious symbolic link. ### Attack Path 1. A process unrelated to the target daemon has `cc-connect` somewhere in its full command line, or an attacker deliberately starts such a process. 2. The Skill invokes `pgrep -f 'cc-connect'` and obtains the unrelated process ID. 3. The command sends termination signals and may forcibly kill that process. 4. The Skill rem ...[truncated 1055 chars]- Remediation
View remediation
/exe` or an equivalent operating-system API resolves to the expected executable. - The process start time matches the daemon instance represented by the PID file. - Send `SIGTERM`, wait with a bounded polling loop, and use `SIGKILL` only after explicit confirmation that the verified process failed to stop. - Do not use `pgrep -f` as the process identity boundary. - Remove a lock only after proving that its recorded owner no longer exists and that no replacement process has acquired it. - Avoid `--force` unless its exact safety implications are understood and the user explicitly approves it. - Create log files safely with restrictive permissions and exclusive creation, preferably under a private runtime directory such as `$XDG_RUNTIME_DIR`. - Back up and validate the JSON state before restart, and verify that exactly one daemon instance is active afterward. ]]>
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:420- Finding
Session Naming Operation Disables Message Replay-Tracking Control
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The command removes a lock file and forcefully kills processes using broad shell matching. This is dangerous because it combines destructive file operations with process management in a way that can be misapplied, target the wrong processes, bypass normal coordination, and damage service state or availability.
- Content
One-shot kill + restart (minimize round trips):
bash # Stop daemon — aggressive single pass kill $(pgrep -f 'cc-connect') 2>/dev/null; sleep 1; kill -9 $(pgrep -f 'cc-connect') 2>/dev/null; rm -f ~/.cc-connect/.config.toml.lock; sleep 1 # ... make changes to JSON file (include past_id_tracking=False in the same write) ...
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The one-line command chains multiple high-impact operations with shell separators, making review, validation, and partial-failure handling difficult. Chained destructive actions increase the chance of unintended side effects and make command injection or misuse more damaging if any interpolated component is ever introduced.
- Content
One-shot kill + restart (minimize round trips):
bash # Stop daemon — aggressive single pass kill $(pgrep -f 'cc-connect') 2>/dev/null; sleep 1; kill -9 $(pgrep -f 'cc-connect') 2>/dev/null; rm -f ~/.cc-connect/.config.toml.lock; sleep 1 # ... make changes to JSON file (include past_id_tracking=False in the same write) ...
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises very broad natural-language triggers such as generic mentions of 'session name' and Chinese equivalents, which can overlap with ordinary conversation and cause unintended invocation. In this skill, unintended activation is more concerning because the described behavior synchronizes and writes session-name data across multiple local storage locations, creating a risk of accidental state changes or metadata corruption.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest trigger list includes broad phrases such as "session name", "register sessions", and the Chinese term "会话名", which can appear in ordinary discussion rather than a clear request to invoke the skill. Because the file does not provide exclusion conditions or negative examples in the trigger field, these phrases could cause unintended activation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The skill persists session metadata across local JSONL and cc-connect JSON stores, creating durable cross-system linkage of session identifiers and names. Persistent writes are security-relevant because they can expose or retain sensitive project/session information longer than expected and create integrity risks if written incorrectly.
- Content
md Bidirectionally sync session names between Claude Code (CLI + VSCode) and cc-connect (飞书). Three naming systems → two storage locations: - **Claude Code CLI `/rename`** and **VSCode** → both read/write JSONL `custom-title` entry - **cc-connect `/name`** (飞书) → writes own JSON file (`sessions[sN].name` + `session_names[UUID]`) Keeping these two storage locations consistent = all three naming systems are unified.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documented register mode performs broad state repair and mutation, including restoring cleared names, resolving mismatches, updating history, and toggling internal flags. This exceeds the narrow user expectation of syncing names and increases the blast radius of any mistake or misuse.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The register flow fabricates synthetic history entries to alter cc-connect state and display behavior, even though the skill's stated purpose is session-name synchronization. Writing invented conversation history can corrupt application state, misrepresent records, and create hard-to-audit side effects unrelated to naming.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Appending custom-title entries directly into session JSONL changes persistent session records without schema or content validation. Because the title originates from user input and is stored durably, malformed or sensitive data could be embedded into session artifacts and later consumed by other tools.
- Content
Claude Code Side Operations
Write custom-title (CLI + VSCode both read this):
bash python3 -c " import json, os
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 87% confidence
- Finding
The skill explicitly acknowledges and works around persistent daemon-managed state files, indicating it modifies authoritative application storage directly. Direct manipulation of active state files raises integrity and race-condition risks, especially when the daemon may overwrite or partially reconcile changes.
- Content
print(f'\nClaude Code only: {uuid[:8]}... = {cc_sessions[uuid]}')
text ## Daemon Overwrite Problem **cc-connect daemon periodically writes its internal state to the session JSON file**, overwriting any external modifications. This means: - Names set externally get cleared
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to kill processes, delete a lock file, and restart a daemon as part of a naming workflow. That is a significant expansion of capability beyond simple metadata synchronization and can disrupt running services, drop messages, or affect unrelated cc-connect activity if the process match is broad or the environment differs from assumptions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Restarting the daemon after persistent state edits operationalizes those edits and can cause message loss during the documented recovery window. This makes the persistence behavior materially riskier because changes are not just stored but enforced through service interruption and reconnection.
- Content
md # ... make changes to JSON file (include past_id_tracking=False in the same write) ... # Restart daemon nohup cc-connect --force > /tmp/cc-connect.log 2>&1 & disown; sleep 3 # ⚠️ WARN USER: Feishu messages will be ignored for ~5 minutes after restart (past_id_tracking bug). # New messages sent after that window will be processed normally.
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The README presents invocation guidance and instructions in English and Chinese and includes Chinese-only trigger phrases, but does not state whether language selection is optional or how users in other locales should interact with the skill. Under the policy, locale or language constraints should be explicitly optional or justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The natural-language description centers activation and behavior around Chinese trigger phrases and a Feishu-specific workflow, but it does not explicitly state that this locale/tooling constraint is optional or user-selected. This can be a language/locale policy concern when a skill appears to prefer a specific language or collaboration environment without opt-in.
- Content
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- SKILL.md:220