ClawHub
Back to skill

Security audit

Qcsd Quality Gates

Security checks for vulnerabilities and agentic risk

Overview

This quality-gate skill is not malicious, but it overstates automatic checking and repair behavior while its runtime can report success without inspecting the project.

Review before installing. Treat this as a process checklist rather than an enforcement gate unless the implementation is fixed. Use it only where automatic project edits are acceptable, and require review before dependency changes or file modifications.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
src/index.ts:40
Finding

Quality Gate Fails Open Without Performing Project Checks

Content
View full analysis
Remediation
View remediation
0 && allChecks.every(check => check.passed) ``` 5. Return `checked: false` when no scan occurred, when the project cannot be accessed, or when required checks terminate unexpectedly. 6. Treat execution errors as gate failures and return structured error information rather than silently approving the project. 7. Ensure the AI-specific `passed` count is calculated from its check array rather than hardcoded. 8. Align the runtime output with the output schema declared in `skill.json`. 9. Add behavioral tests covering at least: - An invalid or inaccessible project path. - A project with a failed required check. - AI-specific failures causing overall failure. - A successful result only after all required checks execute and pass. - Exceptions during scanning resulting in a failed, not successful, gate. 10. Do not claim that automatic repairs occurred unless each modification is explicitly recorded and successfully verified. ]]>

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are mandatory and extremely broad: they require the skill to run on every new project, every code output, and whenever the user asks for quality checks. In an agent setting, this creates overreach and can cause the skill to activate during ordinary development interactions without clear user confirmation, increasing the chance of unwanted file changes or disruptive workflow interference.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly authorizes automatic modification, repair, and creation of project files in response to errors, including dependency changes, path fixes, syntax fixes, startup-failure remediation, and missing-file creation. In a code-agent context, allowing autonomous write actions without requiring user approval, preview, rollback guidance, or impact warnings can lead to integrity loss, unintended code changes, and potentially unsafe dependency alterations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

标题在 L1 明确使用中文表述，且全文以中文规定技能行为，但没有说明这是可选语言，也未提供语言/locale 选择机制。根据策略，若技能隐含强制特定语言而无用户选择或明确合理的区域限定，属于自然语言政策风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are extremely broad and mandatory, causing the skill to run on nearly every new project, every code output, and any quality-related request. This can override normal user intent and agent routing, creating unwanted behavior amplification and increasing the chance the skill is invoked in inappropriate contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill returns multiple user-facing strings in Chinese such as check names and remediation messages, but there is no indication that language selection is configurable or user-chosen. This can violate language/locale policy requirements because it forces a specific language in normal operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Most of the operational instructions and trigger descriptions are presented only in Chinese, with no indication that users may choose another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale restriction is explicit and justified.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The devDependency uses a caret range (^29.7.0), which allows newer compatible versions to be installed over time. This can introduce supply-chain risk or build instability if an upstream package release is compromised or behaves unexpectedly, though the risk is limited here because it affects a test-only dependency rather than production runtime.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json
"author": "pejic",
  "license": "MIT",
  "devDependencies": {
    "jest": "^29.7.0"
  }
}

Static analysis

No suspicious patterns detected.