Git Sentinel

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:49 PM UTC
• Version: 1.0.0

Overview

This code-review skill mostly matches its purpose, but it ships a registry token and can read arbitrary local files without clear limits.

Review before installing. The publisher should revoke and remove the committed ClawHub token, avoid command-line token passing, pin publishing dependencies, restrict file reads to the Git repository, add size limits and secret redaction, and clearly disclose when code may be sent to an AI model or printed to logs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: clawhub-auth.json:1
• Finding: Plaintext ClawHub Authentication Token Committed to the Package<![CDATA[ ## Vulnerability Details **File Location**: `clawhub-auth.json:1-4` **Vulnerability Type**: Hardcoded authentication credential **Risk Level**: High ### Vulnerable Code ```json { "registry": "https://clawhub.ai", "token": "[REDACTED EXPOSED clh_ TOKEN]" } ``` The token value has been redacted from this report to prevent further credential disclosure. The audited file contains the complete plaintext credential. ### Technical Analysis A ClawHub authentication token is stored directly in a versioned package file. Any user, service, build worker, or package consumer with access to the project can extract the credential without authentication. Embedding credentials in source code or package artifacts prevents effective access control and makes credential rotation difficult. If the token remains valid, it can be submitted to the configured `https://clawhub.ai` registry. The token's exact permissions and current validity were not established during this static audit. ### Attack Path 1. An attacker downloads, clones, or otherwise obtains the project. 2. The attacker opens `clawhub-auth.json`. 3. The attacker extracts the plaintext `clh_` token. 4. The attacker submits the token to the configured ClawHub registry. 5. If the token remains valid, the attacker performs any operations authorized by its assigned scope. ### Impact Assessment Depending on the token's permissions, exploitation could permit unauthorized registry access, package publication, modification of published content, account abuse, or supply-chain compromise. The affected scope is the ClawHub account, namespace, or packages accessible to the exposed credential. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke the exposed token immediately and generate a replacement with the minimum required permissions. 2. Remove `clawhub-auth.json` from the repository and distributed package. 3. Purge the credential from version-control history and previously published artifacts where feasible. 4. Store authentication material in a protected environment variable or operating-system credential store. 5. Add credential files to `.gitignore`, `.npmignore`, and package publication exclusion rules. 6. Enable automated secret scanning in commits and CI pipelines. 7. Review ClawHub activity logs for unauthorized operations performed with the exposed token. 8. Use short-lived, narrowly scoped publication credentials wherever supported. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: sentinel.js:17
• Finding: Unrestricted File Paths Allow Reading Data Outside the Git Repository<![CDATA[ ## Vulnerability Details **File Location**: `sentinel.js:17-65` **Vulnerability Type**: Unrestricted local file read and potential sensitive-data disclosure **Risk Level**: High ### Vulnerable Code ```js const mode = process.argv[2] || 'staged'; const targetFile = process.argv[3]; console.log(`🛡️ Git Sentinel activado... [Modo: ${mode}]`); try { let filesToReview = []; if (targetFile) { filesToReview = [targetFile]; } else { // Obtener archivos en staging const diff = execSync('git diff --cached --name-only', { encoding: 'utf-8' }); filesToReview = diff.split('\n').filter(f => f.trim() !== '' && !f.endsWith('.lock')); } if (filesToReview.length === 0) { console.log("✅ No hay archivos para revisar (stage vacío)."); process.exit(0); } console.log(`🔍 Analizando ${filesToReview.length} archivos...`); const fileContents = filesToReview.map(file => { try { return `--- FILE: ${file} ---\n` + fs.readFileSync(file, 'utf-8'); } catch (e) { return `--- FILE: ${file} (Error leyendo archivo) ---`; } }).join('\n\n'); const prompt = ` ACT AS: Senior Software Engineer & Security Auditor. TASK: Review the following code changes. FOCUS: 1. Logic Bugs (High Priority) 2. Security Vulnerabilities (OWASP Top 10) 3. Code Cleanliness & Readability 4. Performance Issues OUTPUT FORMAT: - 🔴 [CRITICAL]: Must fix. (Bugs/Security) - 🟡 [WARNING]: Should fix. (Bad practice/Perf) - 🟢 [INFO]: Nice to have. (Style/Refactor) - ✅ [SUMMARY]: One sentence verdict (Approve / Request Changes). CODE TO REVIEW: ${fileContents} `; console.log("\n--- ENVIANDO A IA ---\n"); console.log(prompt); ``` ### Technical Analysis The third command-line argument is accepted as a file path without validation. The implementation does not: - Require the path to remain under the current Git repository. - Reject absolute paths or traversal components. - Resolve and validate the canonical path. - Reject symbolic lin ...[truncated 1981 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Determine the Git root with a fixed command and resolve every requested path using `fs.realpathSync()`. 2. Require canonical paths to be descendants of the canonical Git root. 3. Reject absolute paths, traversal outside the root, symbolic links, devices, FIFOs, sockets, and directories. 4. Require an explicit file-review mode rather than treating any third argument as an unrestricted path. 5. Deny known-sensitive filenames and directories such as `.env`, private keys, credential stores, `.git`, and cloud configuration directories unless the user gives informed confirmation. 6. Apply strict per-file and aggregate byte limits before reading content. 7. Use staged diff content rather than reading complete files where possible. 8. Detect and redact likely secrets before constructing the model prompt. 9. Inform users when source code will be sent to an external model and require consent for sensitive repositories. 10. Avoid printing complete source prompts to persistent logs. ]]>

T08 · Insecure Dependencies

Warning

• Location: package.json:23
• Finding: Mutable ClawHub Dependency Version Weakens Supply-Chain Integrity<![CDATA[ ## Vulnerability Details **File Location**: `package.json:23-25` **Vulnerability Type**: Unpinned executable development dependency **Risk Level**: Medium ### Vulnerable Code ```json "devDependencies": { "clawhub": "latest" } ``` ### Technical Analysis The `clawhub` CLI is declared using the mutable `latest` tag rather than an exact reviewed version. The current `package-lock.json` resolves `clawhub` version `0.7.0` from the npm registry and includes integrity metadata, which mitigates the issue when installation strictly honors that lockfile. The package manifest itself nevertheless allows future dependency resolution to select a different release. Publishing automation also invokes `npx clawhub`, which may download a package if a verified local installation is unavailable. A newly compromised, malicious, or incompatible release could therefore execute with the publisher's local privileges. This is not evidence that the currently locked `clawhub` package is malicious. The risk arises from mutable dependency resolution and executable package retrieval. ### Attack Path 1. A developer or CI worker installs dependencies without strictly enforcing the audited lockfile, or runs the publishing script without a local `clawhub` installation. 2. The package manager resolves the mutable `latest` version or `npx` retrieves an available package. 3. The downloaded package executes as the current developer or CI account. 4. A compromised dependency could read workspace files, environment credentials, publication tokens, or alter the package being published. ### Impact Assessment Successful supply-chain exploitation would obtain the filesystem, environment, and network privileges of the user or CI worker running installation or publication. In a release environment, this may include source-code access, registry credentials, build secrets, and the ability to tamper with published artifacts. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `latest` with an exact reviewed version, such as the version currently recorded in the lockfile. 2. Use `npm ci` in CI and publishing environments so installation fails if the lockfile and manifest disagree. 3. Invoke only the verified local executable, for example with `npx --no-install clawhub` or a package script. 4. Do not permit publishing automation to download executable dependencies at runtime. 5. Protect and review lockfile changes through code review and dependency-update automation. 6. Periodically audit dependency provenance, integrity metadata, release history, and known vulnerabilities. 7. Run dependency installation and publishing in a restricted environment with minimal filesystem and credential access. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: publish.sh:1
• Finding: Publication Token Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `publish.sh:1-9` **Vulnerability Type**: Sensitive credential passed through script and process arguments **Risk Level**: Medium ### Vulnerable Code ```sh # Publicar usando el token de entorno o argumento CLAWHUB_TOKEN=$1 if [ -z "$CLAWHUB_TOKEN" ]; then echo "❌ Error: Necesito un token de ClawHub." echo "Uso: ./publish.sh <TOKEN>" exit 1 fi npx clawhub publish . --token "$CLAWHUB_TOKEN" ``` ### Technical Analysis The publication token is accepted as the script's first command-line argument and then passed to `npx clawhub` as another command-line argument. Quoting prevents shell word splitting but does not protect confidentiality. Credentials supplied this way may be recorded in shell history, CI command logs, process-monitoring systems, debugging output, or operating-system process listings. The script comment mentions an environment token, but the implementation only reads `$1`; it does not read a pre-existing protected environment variable. ### Attack Path 1. A publisher runs `./publish.sh <TOKEN>`. 2. The invoking shell or CI system records the command and token. 3. While publication is running, the token is also present in the argument list of the shell and `npx`/ClawHub process. 4. Another account or monitoring service with sufficient process or log visibility retrieves the credential. 5. The attacker reuses the token against ClawHub within its validity period and authorization scope. ### Impact Assessment Exposure grants no more authority than the token already possesses, but it transfers that authority to unintended users or services. Depending on scope, the token may allow unauthorized publication, package replacement, namespace modification, or other registry operations. Exposure may persist in shell histories and CI logs after the publishing process exits. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Read the token from a protected environment variable or ClawHub-supported credential store instead of positional arguments. 2. Avoid forwarding the token as a command-line flag where the CLI supports environment-based or standard-input authentication. 3. Mask the credential in CI logs and disable shell tracing around authentication operations. 4. Use short-lived, narrowly scoped publication tokens. 5. Run publishing from an isolated release environment with restricted process and log visibility. 6. Invoke a pinned local CLI using `npx --no-install` rather than allowing runtime package retrieval. 7. Rotate the token immediately if it has already appeared in command history, process captures, or build logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Known Vulnerable Dependency: undici==7.22.0 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The lockfile pins undici to 7.22.0, and the provided advisory set includes multiple high-severity issues such as request/response smuggling, response queue poisoning, and CRLF injection. Because undici is an HTTP client library used by the dev tool clawhub, exploitation could affect network interactions performed by the tool, especially if it processes attacker-controlled URLs, headers, redirects, or upstream responses.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill activates on very broad user intents like 'code review, check, or audit,' which can cause unintended invocation in unrelated contexts and increase the chance the agent executes repository-reading commands without sufficiently explicit user consent. Because the skill then instructs the agent to run a local Node.js script against staged changes or arbitrary files, overly permissive triggering expands the attack surface for prompt-triggered or context-triggered misuse.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The script invokes `npx clawhub publish` without pinning an exact package version, so execution depends on whatever version `npx` resolves at runtime. If the package is updated maliciously, compromised upstream, or unexpectedly changed, running this publish script could execute attacker-controlled code with access to the supplied token and local files.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script reads full contents of staged or user-specified files and packages them into a prompt intended for AI review, with no warning, consent step, redaction, or file-type restrictions. In a real integration, this can expose secrets, proprietary code, credentials, or personal data to an external model provider or to local logs/stdout, which is especially risky for a developer tool operating over arbitrary repository contents.

Known Vulnerable Dependency: fflate==0.8.2 — 1 advisory(ies): CVE-2026-45820 (fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archive)

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The lockfile pins fflate to 0.8.2, which the supplied advisory data identifies as vulnerable to an infinite loop when parsing a malformed ZIP64 archive. In this file it appears only as a transitive devDependency of clawhub, so the issue is real but primarily presents a denial-of-service risk during development or tooling use rather than direct runtime compromise of the shipped skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "Corezip & Kiri",
  "license": "ISC",
  "devDependencies": {
    "clawhub": "latest"
  },
  "dependencies": {}
}

• Confidence: 95% confidence
• Finding: Using the floating version specifier "latest" for a development dependency makes builds non-reproducible and allows future upstream releases to be pulled in without review. In a security-auditing CLI skill, that increases supply-chain risk because a compromised or malicious clawhub release could alter code-review behavior, exfiltrate repository data, or execute unwanted install/runtime logic.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The script's visible error and usage messages are only in Spanish, which imposes a language choice on users without opt-in. This matches the natural-language policy concern for locale/language restrictions when no justification or alternative is provided.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The module header describes step 4 as sending the structured prompt to an AI through OpenClaw standard input and step 5 as formatting the AI output as a code review report. In the actual code, lines L66-L69 explicitly state this is only simulated and merely print the prompt, so the documentation contradicts the implemented behavior.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script emits user-facing operational messages entirely in Spanish, such as activation, progress, and error text. This imposes a specific language on users without opt-in or justification, which matches the policy concern for locale or language constraints.