Security audit

Git Sentinel

Security checks for vulnerabilities and agentic risk

Overview

This code-review skill mostly matches its purpose, but it ships a registry token and can read arbitrary local files without clear limits.

Review before installing. The publisher should revoke and remove the committed ClawHub token, avoid command-line token passing, pin publishing dependencies, restrict file reads to the Git repository, add size limits and secret redaction, and clearly disclose when code may be sent to an AI model or printed to logs.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: clawhub-auth.json:1
Finding: Plaintext ClawHub Authentication Token Committed to the Package
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: sentinel.js:17
Finding: Unrestricted File Paths Allow Reading Data Outside the Git Repository
Content: View full analysis
f.trim() !== '' && !f.endsWith('.lock')); } if (filesToReview.length === 0) { console.log("✅ No hay archivos para revisar (stage vacío)."); process.exit(0); } console.log(`🔍 Analizando ${filesToReview.length} archivos...`); const fileContents = filesToReview.map(file => { try { return `--- FILE: ${file} ---\n` + fs.readFileSync(file, 'utf-8'); } catch (e) { return `--- FILE: ${file} (Error leyendo archivo) ---`; } }).join('\n\n'); const prompt = ` ACT AS: Senior Software Engineer & Security Auditor. TASK: Review the following code changes. FOCUS: 1. Logic Bugs (High Priority) 2. Security Vulnerabilities (OWASP Top 10) 3. Code Cleanliness & Readability 4. Performance Issues OUTPUT FORMAT: - 🔴 [CRITICAL]: Must fix. (Bugs/Security) - 🟡 [WARNING]: Should fix. (Bad practice/Perf) - 🟢 [INFO]: Nice to have. (Style/Refactor) - ✅ [SUMMARY]: One sentence verdict (Approve / Request Changes). CODE TO REVIEW: ${fileContents} `; console.log("\n--- ENVIANDO A IA ---\n"); console.log(prompt); ``` ### Technical Analysis The third command-line argument is accepted as a file path without validation. The implementation does not: - Require the path to remain under the current Git repository. - Reject absolute paths or traversal components. - Resolve and validate the canonical path. - Reject symbolic lin ...[truncated 1981 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:23
Finding: Mutable ClawHub Dependency Version Weakens Supply-Chain Integrity
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: publish.sh:1
Finding: Publication Token Exposed Through Command-Line Arguments
Content: View full analysis
" exit 1 fi npx clawhub publish . --token "$CLAWHUB_TOKEN" ``` ### Technical Analysis The publication token is accepted as the script's first command-line argument and then passed to `npx clawhub` as another command-line argument. Quoting prevents shell word splitting but does not protect confidentiality. Credentials supplied this way may be recorded in shell history, CI command logs, process-monitoring systems, debugging output, or operating-system process listings. The script comment mentions an environment token, but the implementation only reads `$1`; it does not read a pre-existing protected environment variable. ### Attack Path 1. A publisher runs `./publish.sh `. 2. The invoking shell or CI system records the command and token. 3. While publication is running, the token is also present in the argument list of the shell and `npx`/ClawHub process. 4. Another account or monitoring service with sufficient process or log visibility retrieves the credential. 5. The attacker reuses the token against ClawHub within its validity period and authorization scope. ### Impact Assessment Exposure grants no more authority than the token already possesses, but it transfers that authority to unintended users or services. Depending on scope, the token may allow unauthorized publication, package replacement, namespace modification, or other registry operations. Exposure may persist in shell histories and CI logs after the publishing process exits. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Known Vulnerable Dependency: undici==7.22.0 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The lockfile pins undici to 7.22.0, and the provided advisory set includes multiple high-severity issues such as request/response smuggling, response queue poisoning, and CRLF injection. Because undici is an HTTP client library used by the dev tool clawhub, exploitation could affect network interactions performed by the tool, especially if it processes attacker-controlled URLs, headers, redirects, or upstream responses.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill activates on very broad user intents like 'code review, check, or audit,' which can cause unintended invocation in unrelated contexts and increase the chance the agent executes repository-reading commands without sufficiently explicit user consent. Because the skill then instructs the agent to run a local Node.js script against staged changes or arbitrary files, overly permissive triggering expands the attack surface for prompt-triggered or context-triggered misuse.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The script invokes npx clawhub publish without pinning an exact package version, so execution depends on whatever version npx resolves at runtime. If the package is updated maliciously, compromised upstream, or unexpectedly changed, running this publish script could execute attacker-controlled code with access to the supplied token and local files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script reads full contents of staged or user-specified files and packages them into a prompt intended for AI review, with no warning, consent step, redaction, or file-type restrictions. In a real integration, this can expose secrets, proprietary code, credentials, or personal data to an external model provider or to local logs/stdout, which is especially risky for a developer tool operating over arbitrary repository contents.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fflate==0.8.2 — 1 advisory(ies): CVE-2026-45820 (fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archive)

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The lockfile pins fflate to 0.8.2, which the supplied advisory data identifies as vulnerable to an infinite loop when parsing a malformed ZIP64 archive. In this file it appears only as a transitive devDependency of clawhub, so the issue is real but primarily presents a denial-of-service risk during development or tooling use rather than direct runtime compromise of the shipped skill.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Using the floating version specifier "latest" for a development dependency makes builds non-reproducible and allows future upstream releases to be pulled in without review. In a security-auditing CLI skill, that increases supply-chain risk because a compromised or malicious clawhub release could alter code-review behavior, exfiltrate repository data, or execute unwanted install/runtime logic.
Content: Scanner excerpt · package.json (reported line 24)May include surrounding context.
json
"author": "Corezip & Kiri", "license": "ISC", "devDependencies": { "clawhub": "latest" }, "dependencies": {} }

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's visible error and usage messages are only in Spanish, which imposes a language choice on users without opt-in. This matches the natural-language policy concern for locale/language restrictions when no justification or alternative is provided.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module header describes step 4 as sending the structured prompt to an AI through OpenClaw standard input and step 5 as formatting the AI output as a code review report. In the actual code, lines L66-L69 explicitly state this is only simulated and merely print the prompt, so the documentation contradicts the implemented behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script emits user-facing operational messages entirely in Spanish, such as activation, progress, and error text. This imposes a specific language on users without opt-in or justification, which matches the policy concern for locale or language constraints.
Content: No source excerpt is available for this finding.