ClawHub
Back to skill

Security audit

Argus Design Review

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only frontend review skill with some broad/inconsistent integration documentation, but no hidden execution, persistence, or data exfiltration in the package.

Install this only if you want a frontend-focused design/code review skill. Separately evaluate the GitHub App or composite action before installing those integrations, since they can comment on PRs and are only described here, not included in the package.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
### Confidence Rule

If the technology stack or the target file is not clearly identifiable, **do not guess**. List the item as **unresolved** in the open-questions section instead of flagging it with a fabricated severity or stack. This mirrors the men team's "clarify before acting" rule: unclear context is reported, never assumed.

## Technology Stack Detection

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 1090)May include surrounding context.

md
posite action at `.github/actions/argus-review/action.yml` reads `AGENTS.md` + `SKILL.md` from the argus repo at runtime and injects their contents into the LLM

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The overview narrows scope to 'Pure HTML/CSS/JS codebases' and says 'No runtime code — behavior defined by AGENTS.md + SKILL.md', while later sections describe active operational behaviors such as a GitHub App review gate, scheduled refresh from a live API, release tagging/pushing, and site builds. That is broader than a read-only frontend review skill and creates a manifest-level mismatch between claimed scope and actual documented behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The statement 'Pure documentation repo — no npm install, no build step' is directly contradicted by documented commands and structure elsewhere in the file, including 'cd site && npm run build', deploy-site workflow, Python tooling, and multiple automation workflows. This is not merely incomplete documentation; it actively conflicts with the file's own described behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description says to use the skill when "reviewing frontend code for design quality" and includes broad trigger-style examples such as "帮我 review 这段代码", which can match ordinary code review requests without clearly distinguishing this skill from general review behavior. The file lists examples but does not define boundaries or non-matching cases, so activation conditions remain ambiguous.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The men-specific trigger phrase "Argus review" is generic and lacks domain constraints, making it likely to overlap with ordinary conversation or unrelated review requests. Because the manifest does not provide exclusion conditions or negative examples for this phrase, it could cause unintended skill invocation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 784)May include surrounding context.

md
---
---
<script>
  const data = await fetch('https://api.example.com/data').then(r => r.json());
</script>

// RIGHT — fetch in frontmatter: executes once at build time, page ships with data

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 789)May include surrounding context.

md
---
---
<script>
  const data = await fetch('https://api.example.com/data').then(r => r.json());
</script>

// RIGHT — fetch in frontmatter: executes once at build time, page ships with data

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest presents trigger phrases in Chinese and English but does not state whether users may interact in any preferred language or whether the skill will preserve the user's chosen locale. This can create an implicit language-policy issue because the skill appears to prescribe specific language forms for invocation without an explicit opt-in or language-choice statement.

Content

No source excerpt is available for this finding.