Skills caam
📦
caam
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Manage AI CLI Account Switching with CAAM
Developers with multiple AI CLI subscriptions need controlled ways to track local authentication profiles. CAAM documents commands for profile backup, activation, isolation, rotation, and status checks.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "caam" from https://skillstore.io/skills/dicklesworthstone-caam.md and its manifest at https://skillstore.io/api/skills/dicklesworthstone-caam/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "caam". A developer wants to know which AI CLI account is active before starting work.
Expected outcome:
The response explains using CAAM status checks, interpreting profile matches, and confirming the selected provider before launching a session.
Using "caam". A team lead wants to review whether automatic failover is acceptable.
Expected outcome:
The response lists the rotation behavior, security concerns, policy considerations, and safer alternatives such as manual profile selection.
Using "caam". A consultant wants separate work and personal Codex sessions.
Expected outcome:
The response compares isolated profiles with vault profiles and highlights credential, shell alias, and filesystem boundary risks.
Security Audit
Criticalv8 • 7/6/2026 Open versioned report
Most Markdown backtick detections are false positives because they are documentation, not executable Ruby or JavaScript code. Confirmed risks remain around remote pipe-to-shell installation, sudo installation, OAuth token vaulting, forced file-based auth storage, sensitive home-directory links, shell aliases, and account rotation after rate limits.
1
Files scanned
522
Lines analyzed
24
Review items
0
False positives ignored
Confirmed security concerns (11)
Critical
Pipe to shell pattern
curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_account_manager/main/in
The documented one-line installer pipes a remote GitHub script directly into bash. This is a classic supply-chain risk because fetched code executes without local inspection or checksum verification.
Critical
Pipe to shell pattern
curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_account_manager/main/in
The documented one-line installer pipes a remote GitHub script directly into bash. This is a classic supply-chain risk because fetched code executes without local inspection or checksum verification.
High
Environment file access
| **Gemini CLI** | Gemini Ultra (~$275/mo) | `~/.gemini/settings.json`, `~/.gemini/oauth_credentials
The skill references Gemini .env usage for authentication mode and local credential storage. Environment files commonly contain API keys or OAuth-related secrets.
High
Environment file access
- **Notes:** OAuth cache stored in `oauth_credentials.json`, API key mode uses `.env`.
The skill references Gemini .env usage for authentication mode and local credential storage. Environment files commonly contain API keys or OAuth-related secrets.
High
Credential JSON file
| **Gemini CLI** | Gemini Ultra (~$275/mo) | `~/.gemini/settings.json`, `~/.gemini/oauth_credentials
The referenced oauth_credentials.json file is an authentication credential store. Backing up or restoring it can expose bearer credentials for the Gemini account.
High
Credential JSON file
- **Notes:** OAuth cache stored in `oauth_credentials.json`, API key mode uses `.env`.
The referenced oauth_credentials.json file is an authentication credential store. Backing up or restoring it can expose bearer credentials for the Gemini account.
High
OAuth Bearer Token Vaulting
The skill explains that AI CLI OAuth tokens are plain local files and that possession grants access. It then documents backing up and restoring those tokens between profiles.
The text directly describes bearer-token files and a vault workflow for copying them. This is intentional credential handling, not a coincidental file reference.
High
Rate Limit Circumvention Workflow
The skill is designed to switch accounts after rate limits and rerun commands with another profile. This can enable business-logic abuse of provider usage controls.
The stated purpose and automatic failover steps explicitly connect rate-limit events to selecting another account and re-executing commands.
Show all 11 confirmed findings
Medium
Git config file
Each profile gets its own `$HOME` and `$CODEX_HOME` with symlinks to your real `.ssh`, `.gitconfig`,
The skill documents symlinking or exposing the real ~/.gitconfig into isolated profile homes. This can leak developer identity and trusted Git configuration into wrapped sessions.
Medium
Git config file
└── .gitconfig -> ~/.gitconfig
The skill documents symlinking or exposing the real ~/.gitconfig into isolated profile homes. This can leak developer identity and trusted Git configuration into wrapped sessions.
Medium
Shell Alias Interception of AI Tools
The skill recommends aliases that replace normal Claude and Codex commands with a CAAM wrapper. This can hide automatic account switching behind familiar command names.
The alias blocks explicitly map common AI CLI names to caam run. The risk is contextual command interception rather than the Markdown syntax itself.
Capability review items (24)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo mv caam /usr/local/bin/
The installation instructions move a community-built binary into /usr/local/bin with sudo. This grants elevated install authority to code built from the external repository.
High
Hidden file in home directory
~/.claude.json ←→ ~/.local/share/caam/vault/claude/alice@gmail.com/
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file in home directory
~/.codex/auth.json ←→ ~/.local/share/caam/vault/codex/work@company.com/
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file in home directory
| **Claude Code** | Claude Max ($200/mo) | `~/.claude.json`, `~/.config/claude-code/auth.json`, `~/.
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file in home directory
| **Codex CLI** | GPT Pro ($200/mo) | `~/.codex/auth.json` (or `$CODEX_HOME/auth.json`) |
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file in home directory
| **Gemini CLI** | Gemini Ultra (~$275/mo) | `~/.gemini/settings.json`, `~/.gemini/oauth_credentials
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file in home directory
- **Notes:** Respects `CODEX_HOME`. CAAM enforces file-based auth by writing `cli_auth_credentials_s
The skill says CAAM writes Codex configuration under the user home to force file-based credential storage. This changes auth storage behavior and can weaken protected credential handling.
High
Hidden file in home directory
~/.local/share/caam/
The hidden CAAM data directory is documented as the vault root for saved auth profiles. In context, compromise of this location can expose stored account tokens.
High
Hidden file in home directory
│ │ │ ├── auth.json # From ~/.config/claude-code/
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file in home directory
├── .ssh -> ~/.ssh
The isolated profile structure links the real ~/.ssh directory into a generated home. This can expose SSH keys and agent configuration to wrapped CLI sessions.
High
Hidden file in home directory
└── .gitconfig -> ~/.gitconfig
The isolated profile structure links the real ~/.gitconfig into a generated home. This exposes developer identity and Git behavior across profile boundaries.
High
Hidden file access
~/.claude.json ←→ ~/.local/share/caam/vault/claude/alice@gmail.com/
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file access
~/.codex/auth.json ←→ ~/.local/share/caam/vault/codex/work@company.com/
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file access
| **Claude Code** | Claude Max ($200/mo) | `~/.claude.json`, `~/.config/claude-code/auth.json`, `~/.
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file access
| **Codex CLI** | GPT Pro ($200/mo) | `~/.codex/auth.json` (or `$CODEX_HOME/auth.json`) |
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file access
| **Gemini CLI** | Gemini Ultra (~$275/mo) | `~/.gemini/settings.json`, `~/.gemini/oauth_credentials
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file access
- **Notes:** Respects `CODEX_HOME`. CAAM enforces file-based auth by writing `cli_auth_credentials_s
The skill says CAAM writes Codex configuration under the user home to force file-based credential storage. This changes auth storage behavior and can weaken protected credential handling.
High
Hidden file access
~/.local/share/caam/
The hidden CAAM data directory is documented as the vault root for saved auth profiles. In context, compromise of this location can expose stored account tokens.
High
Hidden file access
│ │ │ ├── auth.json # From ~/.config/claude-code/
The referenced hidden files are AI CLI authentication or OAuth credential files under the user home directory. Copying or restoring them can expose bearer tokens with account access.
High
Hidden file access
├── .ssh -> ~/.ssh
The isolated profile structure links the real ~/.ssh directory into a generated home. This can expose SSH keys and agent configuration to wrapped CLI sessions.
Medium
Hidden file access
└── .gitconfig -> ~/.gitconfig
The isolated profile structure links the real ~/.gitconfig into a generated home. This exposes developer identity and Git behavior across profile boundaries.
Medium
Hidden file access
# Add aliases to .bashrc/.zshrc
The instructions encourage modifying shell startup files so common AI CLI commands are wrapped by CAAM aliases. This changes command behavior persistently for future shells.
Low
Hardcoded URL
curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_account_manager/main/in
The hardcoded GitHub raw URL is used to fetch a remote installer in the documented one-liner. Network access is expected, but it increases supply-chain risk when combined with shell execution.
Low
Hardcoded URL
curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/coding_agent_account_manager/main/in
The hardcoded GitHub raw URL is used to fetch a remote installer in the documented one-liner. Network access is expected, but it increases supply-chain risk when combined with shell execution.
Risk Factors
⚙️ External commands (111)
SKILL.md:15-18 SKILL.md:18-22 SKILL.md:22-24 SKILL.md:24-32 SKILL.md:32-35 SKILL.md:35-37 SKILL.md:37-45 SKILL.md:45-57 SKILL.md:57-75 SKILL.md:75-83 SKILL.md:83-86 SKILL.md:86-94 SKILL.md:94-99 SKILL.md:99-101 SKILL.md:101 SKILL.md:109 SKILL.md:110 SKILL.md:111 SKILL.md:116-121 SKILL.md:121 SKILL.md:122 SKILL.md:125 SKILL.md:126 SKILL.md:134-135 SKILL.md:135-136 SKILL.md:136-137 SKILL.md:137-138 SKILL.md:138-139 SKILL.md:139-140 SKILL.md:140-141 SKILL.md:141-143 SKILL.md:143 SKILL.md:149-150 SKILL.md:150-151 SKILL.md:151-157 SKILL.md:157-158 SKILL.md:158-159 SKILL.md:159-165 SKILL.md:165-166 SKILL.md:166-167 SKILL.md:167-168 SKILL.md:168-169 SKILL.md:169-170 SKILL.md:170-171 SKILL.md:171-172 SKILL.md:172-173 SKILL.md:173-174 SKILL.md:174-180 SKILL.md:180-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-184 SKILL.md:184-185 SKILL.md:185-216 SKILL.md:216-224 SKILL.md:224-225 SKILL.md:225-232 SKILL.md:232-238 SKILL.md:238-250 SKILL.md:250-252 SKILL.md:252 SKILL.md:254-258 SKILL.md:258-265 SKILL.md:265-270 SKILL.md:270-271 SKILL.md:271-272 SKILL.md:272-273 SKILL.md:273-276 SKILL.md:276-280 SKILL.md:280-282 SKILL.md:282-288 SKILL.md:288-294 SKILL.md:294-296 SKILL.md:296-298 SKILL.md:298-302 SKILL.md:302-313 SKILL.md:313-325 SKILL.md:325-327 SKILL.md:327-340 SKILL.md:340-341 SKILL.md:341-342 SKILL.md:342-343 SKILL.md:343-344 SKILL.md:344-345 SKILL.md:345-349 SKILL.md:349-374 SKILL.md:374-380 SKILL.md:380-390 SKILL.md:390-394 SKILL.md:394-411 SKILL.md:411-415 SKILL.md:415-427 SKILL.md:427-431 SKILL.md:431-446 SKILL.md:446-450 SKILL.md:450-463 SKILL.md:463-467 SKILL.md:467-479 SKILL.md:479-484 SKILL.md:484-485 SKILL.md:485-486 SKILL.md:486-488 SKILL.md:488-499 SKILL.md:499-505 SKILL.md:505 SKILL.md:506 SKILL.md:59 SKILL.md:469 SKILL.md:57-75 SKILL.md:467-479 SKILL.md:475
🌐 Network access (3)
📁 Filesystem access (23)
Detected Patterns
Pipe to shell pattern×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/dicklesworthstone-caam/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/dicklesworthstone-caam?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/dicklesworthstone-caam?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dicklesworthstone-caam/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/dicklesworthstone-caam.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Dicklesworthstone. (2026). caam security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dicklesworthstone-caam/audits/8BibTeX citation
@techreport{dicklesworthstone-dicklesworthstone-caam-2026,
author = {Dicklesworthstone},
title = {caam security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/dicklesworthstone-caam/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "caam security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "Dicklesworthstone"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/dicklesworthstone-caam/audits/8"
identifiers:
- type: other
value: "skillstore:dicklesworthstone-caam:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
72
Community
78
Spec Compliance
What You Can Build
Track Personal AI CLI Profiles
Switch between locally saved Claude Code, Codex, or Gemini profiles with visible status checks.
Separate Work and Personal Sessions
Use isolated profiles to keep different AI CLI sessions and local homes separate.
Review Account Rotation Workflows
Evaluate cooldown, failover, and profile health behavior before adopting CAAM in a team environment.
Try These Prompts
Check Current Profiles
Use the CAAM skill to explain how I can check which Claude Code and Codex profiles are active.
Plan a Backup Workflow
Use the CAAM skill to outline safe steps for saving a new local AI CLI profile before switching accounts.
Design Isolated Sessions
Use the CAAM skill to compare vault profiles and isolated profiles for running separate Codex sessions.
Assess Rotation Risk
Use the CAAM skill to identify security and policy risks in automatic profile rotation and failover.
Best Practices
- Keep CAAM vaults local, encrypted where possible, and excluded from backups or synchronization tools.
- Review provider terms and organization policy before using account switching or failover workflows.
- Prefer manual profile activation when working with sensitive projects or production credentials.
Avoid
- Do not pipe remote installation scripts directly into a shell without verification.
- Do not use account rotation to continue work after a provider rate limit blocks a session.
- Do not expose SSH keys or Git configuration to generated profile homes without explicit consent.
Frequently Asked Questions
What does CAAM manage?
It manages local authentication profile workflows for Claude Code, Codex CLI, and Gemini CLI.
Does this skill include the CAAM program?
No. The skill describes an external Go CLI and links installation methods for that project.
Are OAuth tokens sensitive?
Yes. The skill states that possession of these bearer tokens can grant account access.
Can CAAM run profiles in parallel?
The documentation describes isolated profiles that run separate CLI sessions with different local homes.
Is automatic failover always appropriate?
No. Users should review provider limits, security policy, and account rules before enabling failover.
What is the safest installation approach?
Use verified releases or inspect source and checksums before installing any binary or script.
Developer Details
Author
DicklesworthstoneLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
72d5025b022c77f7a51bdf5c1637c689c80e89d1
Maintenance freshness
7/18/2026
Usage
5 downloads · 320 views
File structure
📄 SKILL.md