ClawHub
Back to skill

Security audit

verification-gate

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent code-verification checklist, but it needs review because some guidance can fetch unpinned tools and run tests against real staging systems without enough safety boundaries.

Install only if you are comfortable with a Chinese-language verification workflow and will run it under normal developer permissions. Before following its commands, replace unpinned npx invocations with pinned, locked project dependencies, avoid automatic downloads during verification, get explicit approval before changing git state, and use isolated staging data with scoped credentials for service tests.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:52
Finding

Ambiguous and Unpinned Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:52
Vulnerability Type: Supply-chain exposure through ambiguous, unpinned package resolution
Risk Level: Medium

Vulnerable Code:

bash
npx depcruise --config .dependency-cruiser.cjs src 2>&1 | tail  # Dependency cycle detection, if available

Technical Analysis

The Skill recommends invoking depcruise through npx, while its dependency documentation identifies the relevant package as dependency-cruiser. If the target project does not already contain a trusted local depcruise executable, npx may resolve and download a package from the configured npm registry.

The command does not pin a package name or version and does not prohibit automatic installation. This creates a supply-chain risk because package resolution may execute code that was not reviewed with the Skill. Installation lifecycle scripts and the resolved command run with the same operating-system privileges and environment access as the Agent or user.

Attack Path

  1. The target repository does not have a trusted local depcruise executable.
  2. An attacker publishes, compromises, or otherwise controls the package resolved by the ambiguous npx depcruise invocation.
  3. The Agent follows the Skill and executes the documented command.
  4. npx downloads or resolves the attacker-controlled package.
  5. Package installation hooks or the package executable run on the local system.
  6. The package can access files, environment variables, credentials, and network resources available to the invoking process.

Impact Assessment

Successful exploitation provides code execution with the privileges of the user or Agent running the verification workflow. The affected scope may include the target repository, readable local files, environment-provided credentials, developer tokens, and reachable network services. The command itself does not request elevated privileges, so it does n ...[truncated 50 chars]

Remediation
View remediation

Remediation Suggestions

  • Require dependency-cruiser to be declared at an audited and pinned version in the target project's development dependencies and lockfile.
  • Install dependencies through a lockfile-enforcing command such as npm ci.
  • Prohibit npm from downloading a missing package during verification:
    bash
    npm exec --no -- depcruise --config .dependency-cruiser.cjs src
  • Alternatively, invoke the known local binary directly after verifying its presence:
    bash
    test -x node_modules/.bin/depcruise && \
  node_modules/.bin/depcruise --config .dependency-cruiser.cjs src
  • Treat a missing local binary as NOT_RUN or a configuration failure rather than automatically retrieving executable code.
  • Review dependency provenance, integrity metadata, lifecycle scripts, and lockfile changes before execution.

T09 · Insecure Skill Coding Practices

Note
Location
references/lessons-from-practice.md:17
Finding

Git Working Changes Are Stashed Without Guaranteed Restoration

Content
View full analysis

Vulnerability Details

File Location: references/lessons-from-practice.md:17
Vulnerability Type: Unsafe repository-state modification
Risk Level: Low

Vulnerable Code:

bash
git stash && npm test

Technical Analysis

The diagnostic procedure moves tracked working-tree changes into the Git stash before running tests but does not include a guaranteed restoration operation. If the test command fails, times out, or the Agent session terminates, the user's changes remain absent from the working tree.

The procedure also does not record the exact stash reference it created. In repositories with existing stash entries or concurrent activity, a later generic restoration operation could apply the wrong entry. Additionally, ordinary git stash does not include untracked files by default, so the resulting tree may not represent a genuinely clean baseline and may produce unreliable conclusions about whether a failure is pre-existing.

Attack Path

  1. A user has uncommitted tracked changes in the target repository.
  2. The Agent executes git stash && npm test to compare behavior against a clean state.
  3. Git removes the tracked changes from the working tree and stores them in a stash entry.
  4. The test fails, times out, or the workflow ends before restoration.
  5. The working tree remains modified, and the user may mistakenly believe changes were lost or continue working against an unintended repository state.
  6. If restoration later uses an unverified generic stash reference, the wrong changes may be applied.

Impact Assessment

The issue can disrupt or temporarily conceal uncommitted repository changes and can lead to incorrect test attribution. It does not by itself grant additional system privileges or provide direct access outside the repository. The primary impact is repository integrity, developer workflow reliability, and potential loss of work if the stash is later dropped o ...[truncated 39 chars]

Remediation
View remediation

Remediation Suggestions

  • Obtain explicit user approval before changing the state of a working repository.
  • Prefer a temporary Git worktree so baseline tests do not alter current changes:
    bash
    baseline_dir="$(mktemp -d)"
git worktree add --detach "$baseline_dir" HEAD
(
  cd "$baseline_dir" && npm test
)
status=$?
git worktree remove --force "$baseline_dir"
rmdir "$baseline_dir" 2>/dev/null || true
exit "$status"
  • If stashing is unavoidable, include untracked files when appropriate, create a uniquely named stash, capture its exact object identifier, and restore it through guaranteed cleanup logic.
  • Verify that restoration succeeds before reporting completion.
  • Never use an unqualified git stash pop when pre-existing stash entries may exist.
  • Report baseline testing as inconclusive if repository state cannot be isolated safely.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

该文件全文以中文编写，并多处以命令式口吻规定流程，但没有说明仅适用于中文用户，也未提供语言/locale 选择。按规则，若技能强制特定语言而未取得用户选择或未作合理地域限定，属于自然语言政策问题。

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to run npx depcruise without pinning a version, which allows execution of whatever package version is currently resolved from the registry. If the package is updated maliciously, compromised, or introduces breaking behavior, the verification workflow could execute unreviewed code on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

该 markdown 文件适用 SQP-1。触发条件中包含“完成 feature 或重大代码变更后”“重构之后”“声称‘修完’之前”“每 15 分钟或重大变更后执行”等宽泛描述，缺少明确边界、排除条件或精确触发短语，容易与普通开发对话或一般工作流阶段重叠。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains user-facing instructional content only in Chinese, beginning at L01 and continuing throughout the file. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a policy issue when no alternative language or opt-in is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

技能清单说明中强调“e2e 功能 + 真机是 READY 硬门禁”，而本文档在 L054-L056、L085-L087 中明确把真机验证排除出常规 CI，并允许仅在本地或独立流水线运行，甚至在验证报告中记录缺口原因。这不是简单省略细节，而是对门禁强制性的直接弱化，和技能宣称的硬门禁语义不一致。

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document advises running staging tests with real requests against real databases, networks, and credentials, but provides no safeguards around least-privilege accounts, test-data isolation, rate limits, or privacy controls. In a verification skill, that omission is more dangerous because users may treat the guidance as an approval gate and run impactful tests against shared environments, risking data leakage, unwanted mutations, or service disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire skill document is written in Chinese and does not indicate that other languages are supported or that the language choice is optional. Under the policy criteria, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill content is entirely in Chinese and does not provide an alternative language option or indicate that the locale constraint is justified by a region-specific requirement. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains user-facing instructional content only in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the policy rule for natural-language constraints, forcing a specific language without user choice can be a policy violation.

Content

No source excerpt is available for this finding.