ClawHub
Back to skill

Security audit

Codebase Argus

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent code-review playbook with disclosed use of GitHub, npm, and AI providers, but users should handle repository data and credentials carefully.

Install and run this only from a trusted Codebase Argus checkout, prefer read-only and least-privilege credentials, review CI logs and diffs for secrets before using API providers or tribunal mode, and reserve webhook deployment or sync execution for repositories where automatic comment posting and explicit push/PR flags are acceptable.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:51
Finding

Potential Disclosure of Repository and CI Secrets to External AI Providers

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:51-52, SKILL.md:88-90, and SKILL.md:115-125
Vulnerability Type: Sensitive information exposure through external provider submission
Risk Level: Medium

Vulnerable Code

text
Both upstream and downstream workflows can send the same evidence package to one
provider or a multi-agent tribunal.
bash
OPENAI_API_KEY=<key> npm run argus -- review owner/repo#123 --provider openai-api
ANTHROPIC_API_KEY=<key> npm run argus -- review owner/repo#123 --provider anthropic-api
GEMINI_API_KEY=<key> npm run argus -- review owner/repo#123 --provider gemini-api
bash
npm run argus -- ci-log logs/failure.txt
npm run argus -- ci-log logs/failure.txt --provider codex-cli
npm run argus -- ci-log logs/failure.txt --tribunal codex-cli,claude-cli,gemini-cli
bash
GITHUB_TOKEN=<read-only-token> npm run argus -- ci-github owner/repo#123
GITHUB_TOKEN=<read-only-token> npm run argus -- ci-github owner/repo#123 --provider codex-cli

Technical Analysis

The Skill permits repository evidence and CI logs to be submitted to external AI APIs or provider CLIs. Pull-request diffs, source files, and build logs can contain private source code, access tokens, API keys, personal information, internal URLs, or environment values.

Although SKILL.md:69 instructs users not to print or write tokens, that safeguard does not address secrets already embedded in the evidence package. The Skill does not document automatic redaction, file or content allowlists, outbound-payload previews, destination restrictions, data classification checks, or explicit per-submission consent. Consequently, remote submission may disclose more information than is minimally necessary for code review.

The behavior is related to the declared multi-provider review functionality, but its documented controls are insufficient to enforce least privilege o ...[truncated 1275 chars]

Remediation
View remediation

Remediation Suggestions

  • Keep deterministic local review as the default and require explicit, informed consent before every remote submission.
  • Display the provider destination and a preview or manifest of the exact outbound payload.
  • Apply automatic redaction for access tokens, private keys, passwords, connection strings, authorization headers, personal data, and common cloud credentials.
  • Reject or quarantine evidence containing PEM blocks, high-confidence secret patterns, or values matching configured environment secrets.
  • Introduce repository, file-type, path, and content allowlists; exclude environment files, credential stores, generated artifacts, and sensitive CI output by default.
  • Minimize submitted context to the smallest diff or log fragment required for analysis.
  • Document each provider's retention, training, residency, and deletion policies.
  • Require separate confirmation before tribunal mode sends evidence to multiple destinations.
  • Add tests demonstrating that credentials in diffs and logs are removed before provider invocation.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:57
Finding

Unpinned Third-Party Dependency Installation with No Auditable Implementation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:57-60
Vulnerability Type: Unverifiable and potentially mutable npm dependency installation
Risk Level: Medium

Vulnerable Code

bash
npm install
npm run argus -- review owner/repo#123

Technical Analysis

The audited project contains only SKILL.md. It does not include the referenced package.json, a lockfile, integrity metadata, or the executable implementation behind npm run argus. The instructions therefore assume that the user has obtained a separate “Codebase Argus checkout,” but they do not identify an immutable revision or require dependency verification.

Running npm install can install a mutable dependency graph and execute package lifecycle scripts under the invoking user's account. Without an auditable manifest and lockfile in the reviewed artifact, the audit cannot verify dependency identities, versions, integrity hashes, lifecycle behavior, or the claimed safeguards around tokens, webhooks, filesystem access, and Git operations.

This is a supply-chain weakness rather than evidence that a malicious package is currently present. The risk arises because the documented execution path relies on external, unaudited components whose behavior can differ from the reviewed Skill.

Attack Path

  1. A user obtains a mutable or compromised Codebase Argus checkout corresponding to the documentation.
  2. An attacker modifies a dependency, package manifest, lockfile, installation script, or upstream package release.
  3. The user follows the Skill instructions and executes npm install.
  4. npm installs the compromised component and may execute its lifecycle scripts.
  5. Malicious code runs with the invoking user's permissions and can access files, repositories, network connectivity, and credentials available to that process.

Impact Assessment

A compromised dependency or lifecycle script could execute arbitrary code with the privileges o ...[truncated 489 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the executable implementation, package.json, and lockfile in the auditable Skill package.
  • Reference an immutable repository commit or signed release rather than an unspecified checkout.
  • Use exact dependency versions and integrity-protected lockfiles.
  • Prefer npm ci over npm install for reproducible installation.
  • Use npm ci --ignore-scripts where lifecycle scripts are unnecessary; otherwise, explicitly audit and document every required lifecycle script.
  • Verify package provenance, release signatures, registry source, and integrity hashes before installation.
  • Run installation and review commands in a restricted environment with minimal credentials, filesystem access, and network permissions.
  • Separate installation from environments containing GitHub App private keys, webhook secrets, or provider API credentials.
  • Add automated dependency auditing and lockfile review to the release process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.