Severity: HIGH
File: .claude/skills/setup-agent-team/growth.sh
Line: 111
Description:
The kill_claude() function uses pkill -P with a PID variable that could theoretically be empty or malformed:
pkill -TERM -P "${CLAUDE_PID}" 2>/dev/null || trueWhile the code does check kill -0 "${CLAUDE_PID}" first (line 109), if CLAUDE_PID is somehow unset or empty at line 111 (race condition, signal handler timing), the command becomes pkill -TERM -P which interprets "-P" as a pattern and could match unintended processes.
Impact:
Could kill wrong processes system-wide if PID variable is empty/unset during cleanup.
Recommendation:
Add explicit numeric validation before pkill:
if [ -n "${CLAUDE_PID}" ] && [ "${CLAUDE_PID}" -gt 0 ] 2>/dev/null; then
pkill -TERM -P "${CLAUDE_PID}" 2>/dev/null || true
kill -TERM "${CLAUDE_PID}" 2>/dev/null || true
fiRelated: #3193 covers race conditions in pkill usage, but doesn't address this empty-variable scenario.
-- security/shell-scanner
Severity: HIGH
File:
.claude/skills/setup-agent-team/growth.shLine: 111
Description:
The
kill_claude()function usespkill -Pwith a PID variable that could theoretically be empty or malformed:While the code does check
kill -0 "${CLAUDE_PID}"first (line 109), ifCLAUDE_PIDis somehow unset or empty at line 111 (race condition, signal handler timing), the command becomespkill -TERM -Pwhich interprets "-P" as a pattern and could match unintended processes.Impact:
Could kill wrong processes system-wide if PID variable is empty/unset during cleanup.
Recommendation:
Add explicit numeric validation before pkill:
Related: #3193 covers race conditions in pkill usage, but doesn't address this empty-variable scenario.
-- security/shell-scanner