ClawHub
Back to skill

Security audit

Argus

Security checks for vulnerabilities and agentic risk

Overview

Argus is a disclosed checkpointing skill that can persist selected durable context into local Git-backed archives, so it is appropriate when that is the behavior the user wants.

Install this only in workspaces where you want the agent to write selected decisions, commitments, preferences, evidence, and project state into your local archives. Review the default checkpoint prompt before enabling it broadly, keep registries private, and require confirmation or repository rules for sensitive personal, business, legal, financial, or budget records.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 3)May include surrounding context.

md
# Security

Please report vulnerabilities privately through GitHub's security advisory interface. Do not include credentials, private documents, access tokens, internal hostnames, or personal paths in a public issue.

This project provides agent instructions and local helpers. It is not a sandbox, an authorization system, or a guarantee that an external service is secure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about writing or routing durable context into Git-backed records when users ask to archive, remember, checkpoint, or capture state. The supplied code does not archive, remember, or update records. Instead, it loads an archive registry, parses archivum:// links from a home index, verifies referenced archives exist, ensures paths do not escape archive roots, checks targets exist, and validates home-anchor backlinks. Its primary purpose is consistency checking and reporting validation failures via a command-line interface. That is a materially different behavior from the declared archival/persistence function.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description promises a skill used to preserve durable context and update Archivum-style workspaces with commitments, evidence, decisions, preferences, and project state. The code instead only discovers registries and candidate Archivum directories by reading filesystem paths, parsing a TOML registry, checking for config.yaml / 00_meta / AGENTS.md, and reporting findings. It is explicitly non-mutating ('without mutating them') and contains no logic for writing records, committing context, updating Git-backed files, or handling the declared triggers like archive/remember/checkpoint. This is a material description-behavior mismatch, not just an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description is about operationally capturing and persisting durable workspace state into Git-backed records. The actual code chunk does not archive, remember, checkpoint, or write canonical project context records. Instead, it is test code for supporting Archivum infrastructure: discovery of configured archives, reading config.yaml, detecting AGENTS.md, and validating backlink safety. While this is related to the Archivum ecosystem, its primary purpose is materially different from durable-state capture, so the description does not accurately represent the supplied code.

Content

No source excerpt is available for this finding.

Context Leakage

High
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill is explicitly designed to preserve conversation-derived context into Git-backed records, creating a real risk of storing sensitive information, private preferences, or operational details beyond the ephemeral session. Although the text says not to archive secrets outside their authorized store, the triggering and routing model still increases the chance of context leakage into persistent repositories.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: argus
description: Preserve durable context from conversations and completed work by routing commitments, evidence, decisions, preferences, and project state to their canonical Git-backed records. Use when the user asks to archive, remember, checkpoint, capture context, update an Archivum-style workspace, or close the loop; also use at natural milestones when workspace instructions require durable-state capture.
---

# Argus

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill instructs the agent to run shell commands, read configuration and registry files, and potentially write archive records, but it does not declare any explicit tool scope or permission boundaries. That increases the risk of over-privileged execution, especially because the skill touches multiple repositories and environment-derived paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger language is broad and includes generic phrases like 'remember,' 'capture context,' 'close the loop,' and invocation at 'natural milestones,' which can cause the skill to activate without sufficiently specific user consent. Because the skill can write durable records and inspect multiple archives, accidental invocation may persist sensitive or unnecessary context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The default prompt uses a broad activation phrase, 'Use $argus to checkpoint this conversation’s durable changes,' without defining precise trigger boundaries or requiring explicit user confirmation. In a memory-preservation skill, ambiguous activation can cause the agent to persist conversation content or inferred commitments more often than intended, creating privacy, integrity, and over-collection risks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_argus.py (reported line 73)May include surrounding context.

python
self.temporary.cleanup()

    def run_script(self, script: str, *arguments: str) -> subprocess.CompletedProcess[str]:
        return subprocess.run(
            [sys.executable, str(SCRIPTS / script), *arguments],
            check=False,
            capture_output=True,

Scope Creep

Low
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
- Batch related deltas; never checkpoint after every edit or tool call.
- Do not recursively archive the mechanical fact that Argus updated an archive.
- If nothing durable changed, make no write and say nothing about capture.
- Treat a checkpoint as preservation authority, not permission to broaden scope or perform unrelated external actions.

Use [checkpoint-prompt.md](references/checkpoint-prompt.md) to make Argus available automatically in repository-aware agents.

Static analysis

No suspicious patterns detected.