clawgod-claude-code-patch

Remote Code Execution from Untrusted Sources

• The skill provides instructions and commands to download and execute shell scripts and PowerShell scripts directly from an external GitHub repository (github.com/0Chencc/clawgod).
• Specifically, it uses the patterns curl -fsSL ... | bash and irm ... | iex, which pipe remote content directly into a shell interpreter. This is a critical security risk as the remote content is not verified and can be modified at any time by the repository owner.
• Evidence found in SKILL.md:
  • curl -fsSL https://github.com/0Chencc/clawgod/releases/latest/download/install.sh | bash
  • irm https://github.com/0Chencc/clawgod/releases/latest/download/install.ps1 | iex

Bypassing Safety Restrictions

• The skill explicitly instructs the agent to bypass security and content guidelines. It claims to remove the CYBER_RISK_INSTRUCTION, which is designed to prevent the generation of harmful code related to penetration testing, exploits, and C2 infrastructure.
• It also removes URL Restriction and Cautious Actions (confirmations before destructive operations), significantly increasing the risk of malicious or accidental harm.
• The triggers for the skill include phrases like "bypass claude code limits" and "remove claude code restrictions," which are indicative of prompt injection intent to override safety protocols.

High-Privilege Capability Enablement

• The skill enables "Computer Use" features (controlling screen, mouse, and keyboard) without a subscription, bypassing intended access controls. This capability is high-risk as it allows an LLM-driven agent to interact with the local operating system interface directly.

Persistence and Modification of Binaries

• The installation process involves patching the claude binary and creating a backup (claude.orig). This indicates the skill modifies application code on the local filesystem to achieve persistent behavioral changes.

Deceptive Branding and Metadata

• The skill modifies the visual presentation (brand color change to green) of the application to indicate the "patch" is active. This could be used to deceive users about the integrity of the software they are running.