ClawHub
Back to skill

Security audit

Argus Design Review

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed frontend design review helper that reads code to produce review findings and fixes, with no artifact-backed hidden exfiltration, destructive action, or persistence.

Install this for frontend design review workflows. If using the separate GitHub App or composite action mode, review and pin that external automation separately because it can read PR code and post review comments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Memory Manipulation

High
Category
Memory Poisoning
Content
### Confidence Rule

If the technology stack or the target file is not clearly identifiable, **do not guess**. List the item as **unresolved** in the open-questions section instead of flagging it with a fabricated severity or stack. This mirrors the men team's "clarify before acting" rule: unclear context is reported, never assumed.

## Technology Stack Detection
Confidence
80% confidence
Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Ae1

High
Category
analysis-evasion
Content
posite action at `.github/actions/argus-review/action.yml` reads `AGENTS.md` + `SKILL.md` from the argus repo at runtime and injects their contents into the LLM
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Vague Triggers

Medium
Confidence
90% confidence
Finding
The description includes broad activation phrases such as “帮我 review 这段代码” and “Argus review,” which are common ways a user might ask for general code review rather than this specific frontend design-audit skill. Because the trigger list lacks exclusion conditions or narrower scope constraints, the skill may activate unintentionally for unrelated review tasks.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The men-specific triggers include phrases like “Argus review” and “run Argus on this PR,” which do not clearly constrain the request to frontend design review. In a broader agent environment, these phrases could collide with ordinary requests for any Argus-based review and cause unintended invocation.

External Transmission

Medium
Category
Data Exfiltration
Content
---
---
<script>
  const data = await fetch('https://api.example.com/data').then(r => r.json());
</script>

// RIGHT — fetch in frontmatter: executes once at build time, page ships with data
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
---
---
<script>
  const data = await fetch('https://api.example.com/data').then(r => r.json());
</script>

// RIGHT — fetch in frontmatter: executes once at build time, page ships with data
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low
Confidence
66% confidence
Finding
The trigger description prominently specifies Chinese trigger phrases and mixes them with English without stating whether users may interact in any preferred language. This may create an implicit locale expectation without explicit user opt-in or a documented justification for language constraints.

Static analysis

No suspicious patterns detected.