Security audit

Asf V4

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but its governance and optimization features rely on missing external code and expose under-scoped security controls that users should review before installing.

Review this skill carefully before installing. Do not rely on its veto or optimizer decisions until the core synthesizer code is bundled or pinned, the active policy source is clear, caller-provided rules cannot bypass mandatory controls, and session logging or live optimization is explicitly opted in with warnings.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

Location: DEPLOYMENT-GUIDE.md:127
Finding: Unpinned Remote Package Execution Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index.ts:64
Finding: Caller-Controlled Veto Rules Can Replace Trusted Governance Policy
Content: View full analysis
; approvals?: Array<{ authority: string; scope: string; status: string }>; rules?: any[]; }) => { const enforcer = params.rules ? new VetoEnforcer(params.rules) : createDefaultVetoEnforcer(); return enforcer.enforce( { changes: params.changes }, params.approvals || [] ); }, ``` ### Technical Analysis The public `veto-check` tool accepts an arbitrary `rules` array from the same caller whose requested changes are being evaluated. When this field is present, the trusted default policy is completely replaced: ```typescript new VetoEnforcer(params.rules) ``` There is no authorization check restricting who may supply custom rules, no validation that mandatory hard-veto rules remain present, and no merge with an immutable minimum policy. A caller can therefore submit an empty or permissive ruleset and cause the check to evaluate the requested change under attacker-selected policy. This violates the security principle that authorization policy must be controlled independently from the subject requesting authorization. ### Attack Path 1. A workflow uses `veto-check` as a gate before accepting or deploying a protected change. 2. An untrusted caller submits a change affecting a resource that would normally require architect or security approval. 3. The caller includes a permissive `rules` value, such as an empty array. 4. The tool constructs `VetoEnforcer` using only the caller-provided rules. 5. Default hard-veto rules are omitted from evaluation. 6. The tool may return a passing result. 7. A downstream workflow that trusts this result permits the otherwise restricted change. The final outcome depends on the external `VetoEnforcer` im ...[truncated 675 chars]
Remediation: View remediation
{ return trustedVetoEnforcer.enforce( { changes: validateChanges(params.changes) }, validateApprovals(params.approvals || []) ); }; ``` 2. Load governance policy only from a trusted, administrator-controlled configuration source. 3. Construct and freeze the enforcer during initialization rather than once per untrusted request. 4. If custom policy is a required administrative feature: - expose it through a separate privileged management API; - authenticate and authorize the administrator; - validate the policy schema; - preserve immutable baseline hard-veto rules; - audit every policy change. 5. Reject empty policy sets and fail closed if policy loading or validation fails. 6. Add tests proving that caller input cannot remove mandatory architect and security approval requirements. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: config/asf-v4.config.yaml:10
Finding: Advertised YAML Governance Rules Are Not Loaded by Runtime Checks
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: index.ts:13
Finding: Security-Critical Implementation Is Loaded from Files Outside the Skill Artifact
Content: View full analysis
{ const { VetoEnforcer } = require('../../src/core/synthesizer'); const enforcer = new VetoEnforcer(); return enforcer.enforce(params.changes, params.approvals); }, 'asf-ownership-proof': async (params: any) => { const { generateOwnershipProof, validateProofs } = require('../../src/core/synthesizer'); const proofs = generateOwnershipProof(params.resources, params.roles, params.rules); return validateProofs(proofs); }, 'asf-economics-score': async (params: any) => { const { computeEconomicsScore } = require('../../src/core/synthesizer'); return computeEconomicsScore(params.assignment, params.dag, params.roles); }, ``` ### Technical Analysis The central veto, ownership, optimizer, conflict-resolution, and economics behavior is not included in the reviewed project. Instead, it is imported through relative paths that ...[truncated 2043 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents an industrial governance/safety capability module offering operational features like veto execution, ownership proof, economics scoring, rework risk prediction, and security optimization. However, this code chunk does not implement those business capabilities directly; its primary purpose is to benchmark performance of imported components and integrations, collect timing/memory statistics, compare them to thresholds, report to console, and terminate with pass/fail status. While some benchmarked targets align with declared features (veto enforcement, ownership proof, economics score), the chunk itself is a test/performance harness rather than the described enhancement module. It also includes benchmarking for memory and agent-status extensions not mentioned in the description, and it does not show rework risk prediction or security online optimization behavior. Therefore the description does not accurately represent this code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description promises substantive industrial governance and optimization capabilities: executing veto power, proving ownership, economic scoring, predicting rework risk, and performing online safety optimization. The supplied code does not implement those behaviors. Instead, it extends agent status objects with KPI, budget, and governance fields, derives a few threshold-based suggested actions from KPI values, and stores/retrieves this data from a local registry. While some field names align loosely with the declared domain (governance, budget, ownershipProofValid), the behavior is limited to status aggregation/annotation rather than enforcement, modeling, prediction, or optimization. Therefore the declared description materially overstates the actual functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description advertises high-level industrial governance, economics, risk prediction, and safety optimization features. This code chunk does not implement those capabilities. Instead, it serves as an integration barrel/manager that aggregates three extensions, logs initialization status, and clears memory/registry state during cleanup. While one exported module is named 'SecurityAuditExtension', this chunk itself only wires modules together and reports status; it does not demonstrate the declared veto, ownership, scoring, prediction, or optimization behaviors. Therefore the description materially overstates and misrepresents the code’s actual purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad industrial governance and optimization module with active decision/enforcement and analytical capabilities: veto rights execution, ownership proof, economics scoring, rework risk prediction, and security optimization. The supplied code does not implement those functions. Instead, it is narrowly a memory integration layer: it defines an AsfMemoryEntry schema, logs and caches change events, supports history queries by time/tags/action/project, calculates basic aggregates like counts and average risk/blast radius, and provides cache clear/size helpers. While storing governance events could support a larger governance system, this chunk’s actual primary purpose is change-event storage and retrieval, which is materially different from the declared primary purpose. Therefore this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The code partially matches the description: it does provide governance-related gate checks, veto enforcement, ownership proof validation, and a form of rework risk assessment. However, the declared description promises broader capabilities including economics scoring and security online optimization, which are not present in this chunk. The budget check is only a utilization threshold monitor, not a general cost/economics scoring model. Likewise, there is no optimization behavior—only validation, warning generation, and summary reporting. The rework risk feature is implemented as a basic heuristic rather than a robust prediction capability. Therefore the description overstates the implemented behavior enough to count as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a feature-rich industrial module that implements governance controls, cost/economic modeling, risk prediction, and safety optimization capabilities. The supplied code does not implement those functions; instead, it performs static repository checks via shell commands and pattern matching, acting as a security/compliance audit utility. Some checked items reference veto rules, ownership proof validation, and safe optimizer fields, but the script only verifies that related strings/configurations exist in files rather than executing vetoes, validating proofs, computing economics, predicting rework risk, or performing optimization. This is a material mismatch in primary purpose and actual capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file explicitly tells the user to input account credentials during login, but it provides no accompanying warning about credential sensitivity, trusted terminal context, or avoiding credential exposure in shared environments. Under the markdown-specific missing-warning rule, credential-handling behavior that affects user privacy should be disclosed clearly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide instructs users to enable session_logs alongside the skill without any privacy or data-handling warning. In agent environments, session logging can capture prompts, secrets, internal code, credentials, and operational context, so normalizing its activation without disclosure increases the risk of sensitive data exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · MANUAL-PUBLISH.md (reported line 50)May include surrounding context.
md
### 步骤 3: 创建新技能 1. 点击 "Create Skill" 或 "发布技能" 2. 填写技能信息: - **Name**: ASF V4.0 工业化增强 - **Slug**: asf-v4

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file includes an API-based publish flow that requires exporting a CLAWHUB_TOKEN and sending it in an Authorization header to a remote service. The instructions do not warn users to protect the token, avoid shell history leakage, or recognize that publishing transmits skill metadata to an external service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · MANUAL-PUBLISH.md (reported line 169)May include surrounding context.
md
# 获取 API Token (从 ClawHub 设置页面) export CLAWHUB_TOKEN="your-api-token" # 使用 curl 发布 curl -X POST https://clawhub.ai/api/skills \ -H "Authorization: Bearer $CLAWHUB_TOKEN" \ -H "Content-Type: application/json" \

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents the skill report entirely in Chinese from the title onward, with no indication that language is configurable or chosen by the user. Under the policy rule, forcing a specific language without opt-in is a natural-language locale violation unless the restriction is documented and justified.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The document instructs users to run npx ts-node benchmarks/performance-benchmark.ts without pinning an exact package version. If ts-node is not already installed locally, npx may resolve and execute a package version from the registry that differs from what was tested, creating a supply-chain and reproducibility risk. In this skill context, the danger is elevated because the file is explicitly a production-readiness and deployment guide, so operators may copy-paste the command in real environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The deployment and rollback sections instruct users to modify configuration files, enable or disable skills, install packages, build code, and perform git checkout without clearly warning that these actions alter the local environment and may disrupt an existing installation. This is dangerous because users may execute the steps on production or shared systems without backups, change review, or understanding side effects, leading to service interruption or state loss. The skill context makes this more relevant because the document claims production readiness and provides operational runbooks that are likely to be followed directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This deployment checklist again includes npx ts-node without an exact version, which can cause unreviewed code from a registry-resolved package to execute on the operator machine. Because this appears in an installation/verification workflow, it is especially likely to be run verbatim, increasing the practical supply-chain risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The publish instructions direct the user to log in and enter a username and password, but provide no guidance on secure credential handling, phishing awareness, password manager use, or whether a token-based flow is preferred. In a publication workflow, normalizing raw password entry in CLI instructions can increase the chance of credential misuse, shoulder-surfing, shell history capture by wrappers, or training users into unsafe authentication habits.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The guide tells users to run npx ts-node benchmarks/performance-benchmark.ts without pinning a specific package version or requiring a locally installed dependency. In environments where ts-node is not already present, npx may fetch and execute code from the registry at runtime, which introduces supply-chain risk and reduces build reproducibility.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The publishing instructions require copying Chinese-only values for the Skill Name and Description fields, and the rest of the guide is also written entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide includes a strong security assurance claim ('100% audit passed', 23/23) without providing evidence, references, or verifiable audit artifacts in the file. This can mislead reviewers or users into overtrusting the skill's safety posture, reducing scrutiny during publication and installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown documents safe-optimize as 'Safe online optimization' and shows it taking live metrics and returning whether changes were rolled back, which implies the skill may apply operational changes to a project. There is no explicit user warning in the README about potential impact to running systems or project configuration before using this capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation promotes '安全在线优化' and rollback-protected online optimization without clearly warning that optimization actions may alter running system behavior. In an agent skill context, users may enable or invoke these capabilities expecting them to be harmless analysis, increasing the chance of unintended production-impacting changes or unsafe trust in automated actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The sample configuration enables the optimizer by default (enabled: true) while the surrounding documentation does not provide a prominent warning, dry-run mode, or approval requirement. In a safety-sensitive automation skill, secure defaults matter: users may deploy the config as-is and unknowingly permit autonomous behavior changes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module exposes administrative-style functions that allow any importer to enumerate all agent status entries and clear the entire in-memory registry. Even though this appears intended for development, these operations bypass least-privilege boundaries and could enable unauthorized bulk data access or destructive state resets if the module is used in a larger agent runtime or shared process.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/security-audit.sh:52