claude-audit

• Outcome: Pass
• Latest audit: May 28, 2026 · 7:11 AM UTC
• Version: 1.0.0

Overview

This is a disclosed code-audit skill with optional code-fixing and a user-directed installer, but users should be careful with auto-fix and one-line installation.

Install manually or inspect the installer before using the one-line command. Run /audit without --fix first, scope sensitive repositories with a path, --changed, --focus, and .auditignore, and only use --fix on a clean version-controlled branch where you can review and revert changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet its instructions require shell-capable operations such as git diff and potentially file-modifying actions later in the workflow. This creates a transparency and trust problem: users may invoke a supposedly harmless audit skill without realizing it can access the shell and operate over the working tree.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest and description market the skill as a read-only audit tool, but the documented behavior includes fix application and broader operational capabilities inconsistent with that claim. Description-behavior mismatches are dangerous because they defeat informed consent and can lead users to authorize actions they would not have accepted if accurately described.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill presents itself as read-only, but its documented workflow later allows modifying project files to apply fixes. This is a capability escalation against user expectations and can result in unauthorized code changes, especially in sensitive repositories.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill instructs sub-agents to remain read-only, but the overall skill later directs file modification during fix application. This inconsistency can confuse users and implementers, making it easier for write actions to occur under the guise of a read-only audit.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is presented as a read-only audit tool, but its documented behavior includes an auto-fix mode that applies code changes. This mismatch is dangerous because users or calling systems may grant it broad repository access under the assumption that it only analyzes, while the skill can in fact modify source code without a separate safety boundary.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The instructions establish a global read-only expectation for every agent, but later sections direct the overall skill to edit files during fix application. Contradictory safety semantics increase the risk of unsafe automation, policy bypass, and accidental writes because reviewers and users cannot rely on the declared trust boundary.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The later 'Apply Fixes' section operationalizes file modification after earlier documentation frames the skill as an audit tool. Even if the write phase occurs after a report, it still changes the repository and may do so broadly, which can lead to unintended code changes, malicious prompt abuse through crafted findings, or CI/repo integrity issues if invoked automatically.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README advertises `/audit --fix` as immediately applying all fixes, but the surrounding documentation does not clearly emphasize the risk of automatic modification of user code or the need to review a proposed patch first. In a tool that can scan an entire repository and then change files, this increases the chance of unintended destructive edits, especially if users assume the operation is low-risk because the scan phase is read-only.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: Defaulting to a full audit of the current working directory when no arguments are provided is overly broad and may unintentionally sweep large or sensitive repositories. Broad implicit scope increases the risk of unintended shell access, repository inspection, and data exposure through generated reports.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The --fix option allows automatic file modification without a strong upfront warning in the user-facing description. Users expecting an audit-only skill may invoke it without understanding that it can rewrite code, which undermines consent and change-control practices.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The --fix flag is described as skipping confirmation and auto-applying fixes, but the skill description emphasizes auditing and does not prominently warn that code will be modified. This creates a consent and safety problem: a user may invoke the skill expecting analysis and accidentally trigger immediate edits across the project.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Piping a remote script directly into `bash` executes unreviewed code from the network immediately, giving the script full authority of the current user account. If the upstream source, transport path, or publisher account is compromised, users can be silently infected with malware or persistence mechanisms.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The post explicitly advertises an auto-fix mode that can change code 'without asking', but it does not warn users about the risks of unintended code modification, review requirements, or the scope of changes. In the context of an AI-driven code audit/fix tool, this can normalize unsafe use of autonomous write actions and lead users to run potentially destructive or insecure modifications on their codebase.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|----------|---------|-------------|
| `[path]` | `.` (cwd) | Directory to audit |
| `--focus <areas>` | all | Comma-separated: `security`, `bugs`, `deadcode`, `architecture`, `performance` |
| `--fix` | off | Skip confirmation, auto-apply fixes after report |
| `--changed` | off | Only audit files changed vs last commit (`git diff --name-only HEAD~1`) |
| `--severity <level>` | `info` | Minimum severity to show: `critical`, `warning`, `info` |
| `--top <N>` | unlimited | Limit report to top N findings by severity |

• Confidence: 90% confidence
• Finding: The instruction to 'skip confirmation' for --fix delegates autonomous file modification to the skill without an interactive approval step. In a codebase context, this can cause unintended or unsafe edits to source files, especially if findings are inaccurate or the repository contains sensitive production logic.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Flags

- `--focus security,bugs` - run only the agents you need
- `--fix` - auto-fix without asking
- `--changed` - only scan files changed since last commit (great before PRs)
- `--severity critical` - filter noise
- `--top 10` - top N issues only

• Confidence: 96% confidence
• Finding: The phrase '--fix - auto-fix without asking' promotes autonomous decision-making over user code changes with no confirmation step. In a security-sensitive developer tool, removing human approval increases the risk of unsafe edits, broken builds, silent logic changes, or introduction of vulnerabilities, especially when driven by multiple AI agents.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Global (all projects)
mkdir -p ~/.claude/commands
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/audit.md \
  -o ~/.claude/commands/audit.md

• Confidence: 85% confidence
• Finding: Installing the command under `~/.claude/commands` creates persistent behavior that will affect future Claude sessions across projects. Persistence itself is not automatically malicious, but combined with remote-fetch installation it increases risk because a fetched skill can continue influencing later interactions beyond the current project.

External Script Fetching

Low

• Category: Supply Chain

Content

One line:

```bash
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/install.sh | bash
```

Or manually:

• Confidence: 97% confidence
• Finding: The article instructs users to fetch executable content from an external URL at install time. Even aside from the pipe-to-shell issue, remote dependency on mutable content from `main` creates a supply-chain risk if the repository or hosting account is modified maliciously.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# Global (all projects)
mkdir -p ~/.claude/commands
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/audit.md \
  -o ~/.claude/commands/audit.md

# Project-level (this repo only)

• Confidence: 88% confidence
• Finding: Fetching `audit.md` from a remote mutable source into a commands directory installs externally controlled instruction content into the user's environment. In the context of agent skills, that is more dangerous than downloading ordinary documentation because the file may later be interpreted as operational behavior in future sessions.

External Script Fetching

Low

• Category: Supply Chain

Content

## Install

```bash
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/install.sh | bash
```

Or manually copy one file to `~/.claude/commands/audit.md`.

• Confidence: 98% confidence
• Finding: The installation instructions tell users to fetch and execute a remote script directly from the internet. This is dangerous because users do not inspect the script contents, and any compromise of the repository, maintainer account, distribution path, or future script changes could result in arbitrary code execution on the user's machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

One line:

```bash
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/install.sh | bash
```

Or manually:

• Confidence: 99% confidence
• Finding: The `| bash` chain removes the user's opportunity to inspect what was downloaded before execution and is a classic command-chaining abuse pattern. In a skill-installation context, this is especially dangerous because it can bootstrap arbitrary code execution and persistent modification of the user's environment in one step.

Chaining Abuse

High

• Category: Tool Misuse

Content

## Install

```bash
curl -fsSL https://raw.githubusercontent.com/atobones/claude-audit/main/install.sh | bash
```

Or manually copy one file to `~/.claude/commands/audit.md`.

• Confidence: 99% confidence
• Finding: Piping curl output directly into bash is a classic high-risk pattern because it combines network retrieval and immediate shell execution with no inspection or integrity verification. If the remote content is tampered with or unexpectedly changed, the user will execute attacker-controlled shell commands instantly, leading to full system compromise under the user's privileges.

Static analysis

No suspicious patterns detected.