Security audit

claude-code-bridge

Security checks across malware telemetry and agentic risk

Overview

The skill appears to do what it claims, but it gives chat conversations persistent remote control over a local Claude Code terminal and needs careful review before use.

Install only if you trust the publisher and every person or integration that can send messages to the relevant chat. Prefer private chats and sandbox mode, avoid sensitive directories, review every approval carefully, avoid persistent project-wide approvals unless necessary, use /cc history and /cc peek as sensitive operations, and stop sessions when finished.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The README explicitly states that 'Any message' will be forwarded to a live Claude Code terminal session. In a chat-integrated agent, this creates an overly broad trigger surface where unrelated conversation text, accidental messages, or injected content from the messaging channel can be interpreted as terminal/agent input, increasing the risk of unintended file access, command execution, or approval actions.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The English documentation repeats that any message is automatically forwarded to Claude Code, confirming this is intended behavior rather than ambiguous wording. Because the bridge controls a persistent interactive CLI, broad message forwarding materially increases the chance that benign chat content or adversarially crafted messages are executed in a sensitive workflow.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README advertises full remote file read/write and command execution through chat after approval, but does not prominently warn users about the privacy and system-integrity consequences of exposing a real local CLI session to messaging channels. In this context, users may underestimate that approving actions can leak sensitive files, modify repositories, run shell commands, or affect the host system beyond the chat app.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The opening description frames the skill as a 'real, interactive Claude Code terminal session' reachable from chat, but does not pair that claim with an immediate warning about the security implications of remote terminal control. Because this is the primary user-facing summary, omission of explicit risk disclosure makes the capability more dangerous by normalizing high-risk remote access without adequate caution.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This skill explicitly routes every incoming chat message into a persistent Claude Code CLI session and supports approval of tool actions from chat, but the description does not clearly warn users that their messages are being forwarded to a background terminal-like process that may perform actions on their files or system. In a messaging-bridge context, that omission is especially risky because users may believe they are talking to a normal chat agent rather than controlling an active CLI session with persistent state and approval-mediated execution.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.