Datadog Details Claude Code Skill Attack That Can Exfiltrate GitHub Tokens Before Model Review
Summary
Datadog Security Labs describes the Clawsights Claude Code skill’s attempt to steal GitHub tokens and shows dynamic-context commands can run before model review. It recommends reviewing skill locations, disabling shell execution, and monitoring agents.
Key points
- The Clawsights skill attempted to retrieve a GitHub authentication token and upload it to clawsights[.]com.
- Claude Code dynamic-context commands run during preprocessing, before the model sees the rendered skill; a later refusal cannot stop commands that have already executed.
- Skills can load from enterprise, personal, project, plugin, nested-folder, and added-directory locations, creating multiple paths for untrusted instructions to enter an agent session.
- In Datadog’s tests, Opus 4.6 rejected the original skill, but the dynamic-context variant had already executed its commands. Opus 4.7 later ran a modified skill in tests; the article frames this as an implementation observation, not a guarantee.
- The article recommends reviewing all skill locations, requiring review of .claude/ changes, setting disableSkillShellExecution: true where possible, and monitoring suspicious processes and network activity.
- The authors note that malicious skills could also be used for source-code reconnaissance, local secret discovery, package-manager tampering, or staging another payload, depending on permissions and settings.
Article Details
- Attack Vectors
- A malicious skill distributed through a public GitHub repository can be loaded into Claude Code from project, nested-folder, plugin, or added-directory skill locations.
- Dynamic context commands prefixed with ! execute before the rendered skill reaches the model, allowing commands to run before model-level review or refusal.
- The Clawsights skill attempted to retrieve a user's GitHub token with `gh auth token` and send it, along with usage-report data, to an upload endpoint using curl.
- The article reports that the dynamic-context variant ran the credential retrieval and upload before the model could intervene; results varied across model versions and tests.
- Defensive Notes
- Review skills in personal, project-root, nested-project, plugin-provided, and added directories before opening a workspace in a coding agent.
- Require code review for .claude/ changes and inspect dynamic context commands for network access, sensitive-file reads, and secret discovery.
- Disable skill shell execution where possible by setting `disableSkillShellExecution`: true in managed settings.
- Monitor developer workstations and agent environments for suspicious process execution, credential-file access, unexpected outbound connections, and configuration changes.
- Treat search patterns as review leads rather than complete detections; malicious skills may use aliases, wrapper scripts, or encoded payloads.
- If a skill may have executed, determine what ran, what it accessed, where it connected, and which credentials may need rotation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//clawsights[.]com/api/upload | Upload endpoint used by the malicious Clawsights skill to send a GitHub token and usage-report data. |
MITRE ATT&CK
T1059.004 · Unix ShellThe skill used Bash-style dynamic context commands, including commands to retrieve a GitHub token and invoke curl.T1204 · User ExecutionThe attack depended on a developer using or trusting a skill supplied through a repository or another skill location.T1552 · Unsecured CredentialsThe skill attempted to retrieve the user's GitHub authentication token for theft.
Vendors
AnthropicAnthropic’s Claude Code skills documentation lists four normal locations:GitHubIt highlights the Clawsights example, where a skill attempted GitHub token theft, and shows how defenders can reduce risk by reviewing .claude/skills/, disabling shell execution, and monitoring developer workstations.
Products
Claude CodeThe article explains how malicious Claude Code skills can turn trusted coding-agent extensions into a supply chain attack path, especially when dynamic context commands run before the model can inspect them.Claude Opus 4.6In one test, Claude Opus 4.6 identified the Clawsights skill as malicious and refused to run it, but the dynamic context variant executed before the model could intervene.ClawHub#ClaudeCodeCodexTools such as Claude Code, Cursor, and Codex can operate inside developer workspaces, read source code, run commands, and interact with command-line tools.CursorTools such as Claude Code, Cursor, and Codex can operate inside developer workspaces, read source code, run commands, and interact with command-line tools.GitHubIt highlights the Clawsights example, where a skill attempted GitHub token theft, and shows how defenders can reduce risk by reviewing .claude/skills/, disabling shell execution, and monitoring developer workstations.OpenClaw#ClaudeCode