ClawHub
Back to skill

Security audit

Codex Review

Security checks for vulnerabilities and agentic risk

Overview

This code-review skill is purpose-aligned, but it can send reviewed source code to an external API despite contradictory privacy claims.

Install only if you are comfortable with reviewed code potentially being sent to the configured external model provider. Use local-only mode or say to skip the external model for confidential repositories, and avoid enabling API credentials unless you have reviewed the destination, files, and secret-handling expectations.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:45
Finding

Unredacted Source Code May Be Transmitted to a Configurable External API

Content
View full analysis
"}, {"role": "user", "content": ""} ], "temperature": 0.2, "max_tokens": 6000 }' ``` **Fallback**: If API call fails or times out (120s), skip Round 1 and complete with agent-only audit. ``` ```markdown ### Code Volume Control - Single API request: backend core files only (server + routes + db + config) - Send frontend as a second batch if needed - Very large projects (>50 files): summarize file tree first, then scan in priority order ``` ### Technical Analysis The L1 and L3 workflows instruct the agent ...[truncated 2694 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:100
Finding

Predictable Shared Temporary File Permits Clobbering, Tampering, and Cross-Run Data Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill asserts that it does not upload code anywhere, yet later documents sending reviewed code to an external API. This is a material security/privacy misrepresentation: users may authorize use under the belief that code stays local, causing unintended disclosure of proprietary or sensitive source code.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file claims local-only handling and no network transmission of analysis results, but other sections instruct the skill to send code content to an external model endpoint. Even if only selected files are sent, the contradiction can mislead users about confidentiality boundaries and create unauthorized data exposure risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrases are very broad and map to common natural-language requests like "review this" and "audit this," which can cause unintended activation when the skill is available in a general conversation. Because this skill orchestrates deeper review flows and potentially companion skills, accidental invocation could expand scope, consume resources, or route sensitive code into audit workflows without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The shorthand guidance—e.g. saying "review," "audit," or "cross-validate" for different behaviors—creates ambiguous dispatch conditions because these are ordinary verbs a user might use descriptively rather than as an intentional command. In an agent ecosystem, such ambiguity can trigger the wrong review tier or invoke more invasive and expensive analysis paths than the user intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill describes itself as read-only, but it later specifies writing a hotspot JSON file to the system temp directory. While lower severity than external exfiltration, this is still a trust-boundary violation because users may rely on strict non-modification guarantees when handling sensitive repositories or regulated environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

Declaring a default external API endpoint establishes a built-in path for outbound data flow to a third-party service. In this skill context, that increases the chance that users unknowingly send source code off-host, especially when combined with contradictory privacy claims elsewhere in the file.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
## Prerequisites

- **External model API** (optional, for L1 Round 1 and L3): Any OpenAI-compatible endpoint.
  - Set env vars: `CODEX_REVIEW_API_BASE` (default: `https://api.openai.com/v1`), `CODEX_REVIEW_API_KEY`, `CODEX_REVIEW_MODEL` (default: `gpt-4o`)
  - Works without this — falls back to agent-only audit
- **bug-audit skill** (optional): Required for L2/L3. Without it, L2 uses a built-in fallback.
- **curl**: For API calls (standard on macOS/Linux)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Broad trigger phrases like 'review' or '检查下' can cause unintended invocation in ordinary conversation, potentially launching scans, reading code, or transmitting content externally when the user did not intend to activate the skill. In a code-review skill with optional network egress, accidental activation materially increases privacy and operational risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The explicit use of the OpenAI-compatible endpoint in the curl command confirms that reviewed code may be sent over the network to an external service. In a security-audit skill, this is sensitive because the scanned code may include vulnerabilities, credentials, internal architecture, or other confidential implementation details.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

External Model API Call

bash
curl -s "${CODEX_REVIEW_API_BASE:-https://api.openai.com/v1}/chat/completions" \
  -H "Authorization: Bearer ${CODEX_REVIEW_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The explicit use of the OpenAI-compatible endpoint in the curl command confirms that reviewed code may be sent over the network to an external service. In a security-audit skill, this is sensitive because the scanned code may include vulnerabilities, credentials, internal architecture, or other confidential implementation details.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

External Model API Call

bash
curl -s "${CODEX_REVIEW_API_BASE:-https://api.openai.com/v1}/chat/completions" \
  -H "Authorization: Bearer ${CODEX_REVIEW_API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{