ClawHub
Back to skill

Security audit

Empirecms7.5 Php8 Upgrade

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PHP 8 upgrade guide that edits project source files, with backup and per-file validation instructions, but it includes some environment-specific example paths users should review.

Install only if you intend an agent to modify an EmpireCMS 7.5 project for PHP 8 compatibility. Use it on version-controlled or backed-up code, preferably staging first, and consider removing the hard-coded local IP/path examples if publishing it beyond the original environment.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill embeds host-specific internal details such as IP-based environment labeling, directory structure, version-to-host mapping, and targeted file state that are not necessary for a generic PHP 8 upgrade skill. If exposed to untrusted users or shared outside the intended environment, this information can aid reconnaissance by revealing internal topology, custom modules, and likely weak points to probe.

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
The document discloses a concrete local backup path, which is sensitive internal filesystem information unrelated to the general logic of upgrading EmpireCMS for PHP 8. Such path disclosure can help an attacker map the host layout, identify backup locations for theft or tampering, and infer operational practices.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README explicitly describes automated, file-by-file code modifications to a live project but does not clearly warn users that invoking the skill will alter repository files. In a code-modifying upgrade skill, lack of upfront disclosure can cause users to run the process without backups, review gates, or change-control, increasing the risk of unintended destructive changes.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs high-impact source edits across many PHP files but does not begin with a clear safety warning that these changes can break production systems and should be tested in a staging environment first. In an agentic setting, that omission increases the chance of unsafe direct modification of live systems, causing outages or data loss.

Static analysis

No suspicious patterns detected.