ClawHub
Back to skill

Security audit

Review Workflow

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent code-review workflow, but it can automatically run broad local commands, modify files, and collect untracked file contents before enough user control is established.

Review this skill carefully before installing. Use it only in repositories where you are comfortable with automated lint/format/test commands, and avoid running it with untracked secrets present. Prefer changing the workflow to require explicit approval before collecting untracked files, before auto-fixing files, before running npx-based tools, and before any push or history-rewriting guidance.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:168
Finding

Unpinned npx Commands May Download and Execute Untrusted Packages

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:168-169, 432-433
Vulnerability Type: Supply-chain code execution through implicit package retrieval
Risk Level: High

Vulnerable Code

bash
npx eslint --fix . && npx prettier --write .
npx biome check --apply .
bash
npx jest --coverage
npx nyc <test-cmd>

Technical Analysis

The workflow invokes package executables through npx without requiring that they already exist as lockfile-pinned local dependencies. Depending on the installed npm/npx version and configuration, npx can contact the npm registry, retrieve a missing package, and execute its lifecycle or package code.

Consequently, loading the Skill can lead from a local lint or coverage operation to remote third-party code execution. The effective package payload may differ from what was inspected during this audit. The workflow does not enforce:

  • Local-only package resolution.
  • A trusted lockfile.
  • Package version pinning.
  • Registry allowlisting.
  • Integrity verification before execution.
  • Explicit user approval before package retrieval.

Although the named packages are established tools, relying only on package names does not protect against registry compromise, dependency compromise, configuration-based registry redirection, or unexpected resolution when a package is absent locally.

Attack Path

  1. A repository includes a configuration that causes the workflow to select an npx-based lint, formatting, or coverage command.
  2. The relevant executable is not installed locally, or npm is configured to resolve it through an attacker-controlled or compromised registry.
  3. The workflow runs an unpinned npx command.
  4. npx retrieves the remotely resolved package or dependency graph.
  5. Package installation hooks or executable code run with the Agent process's privileges.
  6. The malicious code can access repository files and environment variables, modify files, and initiate network requests subject to host-le ...[truncated 691 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require tools to be declared in a lockfile-backed project dependency set.
  2. Use local-only execution, for example:
bash
npx --no-install eslint --fix .
npx --no-install prettier --write .
npx --no-install biome check --apply .
npx --no-install jest --coverage
npx --no-install nyc <test-cmd>
  1. Prefer package-manager commands that enforce offline or immutable resolution where supported.
  2. Abort with a clear message if the required local executable is unavailable; do not install it automatically.
  3. If installation is necessary, obtain explicit user approval, pin an exact version, use an approved registry, and verify lockfile integrity.
  4. Run third-party development tools in a sandbox with minimal filesystem, environment-variable, and network access.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/diff_parse.py:371
Finding

Untracked Sensitive Files May Be Copied into Plaintext Review Artifacts

Content
View full analysis

Vulnerability Details

File Location: scripts/diff_parse.py:371-399, 426-438; invoked by SKILL.md:102-109
Vulnerability Type: Overbroad sensitive-file collection and unsafe temporary artifact handling
Risk Level: Medium

Vulnerable Code

python
def _untracked_file_diff(path: str, repo_root: str) -> str:
    """Create a unified diff for one untracked file.

    *path* is relative to *repo_root* (as returned by `git ls-files`).
    """
    abs_path = Path(repo_root) / path
    git_path = _to_git_path(path)

    if abs_path.is_symlink():
        return _skipped_untracked_file_diff(path, 0, "symlink")

    try:
        size_bytes = abs_path.stat().st_size
    except OSError:
        return _skipped_untracked_file_diff(path, 0, "stat_error")

    header = [f"diff --git a/{git_path} b/{git_path}", "new file mode 100644"]

    if size_bytes > MAX_UNTRACKED_BYTES:
        return _skipped_untracked_file_diff(path, size_bytes, "max_file_bytes", is_large=True)

    try:
        content = abs_path.read_bytes()
    except OSError:
        return _skipped_untracked_file_diff(path, size_bytes, "read_error")

    if _is_binary_content(content):
        return "\n".join(
            [
                *header,
                f"review-workflow-meta: size_bytes={size_bytes} is_large=false",
                f"Binary files /dev/null and b/{git_path} differ",
            ]
        )
python
if include_untracked:
    raw_paths = _run_git(repo_root, ["ls-files", "-z", "--others", "--exclude-standard"])
    for path in [p for p in raw_paths.split("\0") if p]:
        if _should_skip_untracked(path):
            continue
        parts.append(_untracked_file_diff(path, repo_root))
bash
python "scripts/diff_parse.py" --collect > review_diff.json
# or
python3 "scripts/diff_parse.py" --collect > review_diff.json

Technical Analysis

The collector enumerates every untracked file that is not excluded by Git ignore rules and does not match the li ...[truncated 2288 chars]

Remediation
View remediation

Remediation Suggestions

  1. Reject sensitive filenames and paths before calling stat() or read_bytes(). At minimum, cover .env*, credentials.json, *.pem, *.key, SSH material, cloud credential directories, and token stores.
  2. Prefer an allowlist of source-code and documentation extensions rather than collecting every non-ignored text file.
  3. Present the untracked-file list to the user and require approval before reading contents.
  4. Run secret detection and redaction in memory before serializing any content.
  5. Create temporary artifacts with owner-only permissions, such as mode 0600, in a secure temporary directory.
  6. Use try/finally or equivalent lifecycle management to guarantee deletion on success, failure, interruption, and gate exits.
  7. Avoid persisting full diff contents where possible; pass structured data through a protected pipe or in-memory channel.
  8. Document that .gitignore is not a security boundary and that sensitive files must be excluded independently.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (35)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

声明描述的是一个高层工作流编排 Skill，核心职责应是根据用户请求触发并串联多个子 Skill，覆盖审查、调试、commit 生成和 Git 提交流程。但提供的代码仅是底层 diff 处理工具：从 stdin/文件/--collect 读取 diff，必要时调用 git 命令定位仓库并收集变更，然后解析 diff hunk 并输出 JSON。它没有任何加载 references/.../SKILL.md、调用子 Skill、面向用户触发、代码 review 判断、debug 修复或 commit message 生成的行为。虽然该脚本可能可作为代码审查工作流的支撑组件，但其主要目的与声明的 Skill 能力明显不一致，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says this skill is an orchestration assistant that chains several other skills for end-to-end code review, debugging, commit preparation, and Git workflow actions based on user requests. The supplied code does none of that. It is a narrow utility script for classifying files by language and assigning review-rule references from diff data or file lists. While such classification could support a code review system, the actual code chunk’s primary purpose is materially different from the declared assistant behavior, and it lacks the stated orchestration, triggers, and Git/commit capabilities.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

This duplicate TM1 finding points to the same risky behavior: surfacing force-push instructions inside an orchestration skill that may be treated as authoritative workflow guidance. The danger is heightened by the skill's broad triggers and proactive activation language, which together make unintended repository-changing actions more plausible.

Content

Scanner excerpt · SKILL.md (reported line 623)May include surrounding context.

git commit -m "<完整 commit message>"

3. 推送

git push origin <分支名>

注意：rebase 后使用 --force-with-lease 而非 --force

git push --force-with-lease origin <分支名>

text

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

This duplicate TM1 finding points to the same risky behavior: surfacing force-push instructions inside an orchestration skill that may be treated as authoritative workflow guidance. The danger is heightened by the skill's broad triggers and proactive activation language, which together make unintended repository-changing actions more plausible.

Content

Scanner excerpt · SKILL.md (reported line 623)May include surrounding context.

git commit -m "<完整 commit message>"

3. 推送

git push origin <分支名>

注意:rebase 后使用 --force-with-lease 而非 --force

git push --force-with-lease origin <分支名>

text

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/code-reviewer/references/security-review-guide.md (reported line 75)May include surrounding context.

// ✅ React automatically escapes (but watch dangerouslySetInnerHTML) return

{userInput}
; // Safe return <div dangerouslySetInnerHTML={{__html: userInput}} />; // Dangerous!

text

### Command Injection Prevention

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/code-reviewer/references/svelte.md (reported line 24)May include surrounding context.

$state 基础用法

svelte
<!-- ❌ $state 用于永远不会变化的值 -->
<script lang="ts">
  let config = $state({ timeout: 5000 });  // 不需要响应式
  const API_URL = $state('/api');           // 常量不需要 $state

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/code-reviewer/references/vue.md (reported line 23)May include surrounding context.

ref vs reactive 选择

vue
<!-- ✅ 现代最佳实践：全部使用 ref，保持一致性 -->
<script setup lang="ts">
const user = ref<User | null>(null)
const loading = ref(false)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/code-reviewer/references/vue.md (reported line 23)May include surrounding context.

ref vs reactive 选择

vue
<!-- ✅ 现代最佳实践:全部使用 ref,保持一致性 -->
<script setup lang="ts">
const user = ref<User | null>(null)
const loading = ref(false)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/git-commit/SKILL.md (reported line 83)May include surrounding context.

git add -p

text

**Never commit secrets** (.env, credentials.json, private keys).

### 3. Generate Commit Message

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and sub-skill list describe a workflow composed of background collection, code review, debugging/fixing, commit message generation, and Git operations. However, the body of the skill introduces additional security-analysis stages—dependency vulnerability scanning (Step 1.6) and secret scanning (Step 5.5)—that are not mentioned in the manifest or represented by the declared sub-skills, expanding the actual behavior beyond the stated workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases are broad everyday requests like asking for code review or commit help, which increases the likelihood of unintended activation in contexts where the user did not intend a full multi-step workflow. Because this skill can proceed to run local commands, inspect repository state, and orchestrate additional sub-skills, accidental triggering expands the blast radius and may cause unanticipated file inspection or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instruction to proactively trigger even for generic requests like '提交代码' or '走提交流程' removes ambiguity safeguards and can cause the agent to launch a powerful workflow without clear user consent. In context, this is more dangerous because the workflow includes reading other skill files, running git and language tooling, and potentially proposing Git push operations, all of which should be tied to explicit opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The stated purpose focuses on orchestrating review, debugging, commit-message generation, and Git submission flow. Secret scanning across added lines using gitleaks, detect-secrets, and custom regex/high-entropy heuristics introduces a separate security-auditing capability that is not clearly declared as part of that purpose, especially since it becomes a hard blocking gate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown skill mixes an English metadata description with substantive operating instructions entirely in Chinese. That effectively forces a specific language for users or downstream agents without any opt-in, fallback, or justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The heading note states the guide is for all-language PR review, but the description itself is written as a mandatory Chinese-only instruction without any opt-in, alternative locale, or justification for a region-specific audience. This creates a natural-language locale policy issue because it imposes a language choice on users of a supposedly universal skill reference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown skill reference forces a specific language/locale for its guidance content, which can violate language-choice policy when no user opt-in or justification is provided. The title and introductory description indicate the content is intended as a general Go code review guide rather than a clearly region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file contains core instructional content in Chinese, and there is no indication that the skill offers an alternative language or that the locale restriction is intentionally scoped to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown skill guide presents its instructional content in a single language, which can amount to a language/locale policy violation when no user opt-in or alternative is offered. Nothing in the file indicates that the Chinese-only presentation is intentional for a region-specific or audience-specific compliance reason.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide description is written in Chinese and the remainder of the document is also presented in Chinese, with no indication that users may choose another language. The policy explicitly flags language or locale constraints when they are imposed without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file contains user-facing instructional content in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.