ClawHub
Back to skill

Security audit

codeql-local-triage

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local CodeQL triage helper that reads specified source/SARIF files, writes temporary variant copies, and optionally runs a local CodeQL binary without hidden network, persistence, or alert-management behavior.

Before installing, be comfortable with the skill reading the source/SARIF paths you provide, creating full temporary variant copies under _bisect or --workdir, and optionally running a local CodeQL binary. Prefer official CodeQL downloads, avoid mirror downloads unless you independently verify the official SHA-256, and add _bisect to .gitignore if used inside a repository.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
| **H1** | **Change exactly ONE thing per variant.** Two differences between `t1_control` and a variant voids the whole experiment. | The verdict *is* the attribution. A multi-variable diff cannot be attributed. Guarded by `tests/run_tests.py` (strict byte-comparison of the two fixtures). |
| **H2** | **`t1_control` must reproduce the alert, or stop.** If it reports 0 results, local and remote disagree and **every later verdict is invalid** (script exits `1`). | A conclusion on a non-reproducing baseline is a building on sand. Fix the version mismatch first. |
| **H3** | **Never dismiss, suppress, or close an alert.** No `# lgtm`, no `dismiss` API. The fix is a **rename**, never a suppression comment. | Only GitHub's own scan may change alert `state`. A suppression hides the next real one. |
| **H4** | **Never judge an alert by "it looks wrong".** "Feels like a false positive" is not evidence; run the experiment. | Steps ①② give the path; step ③ makes the verdict reproducible instead of guessed. |
| **H5** | **Never modify the user's source.** Read-only. All artifacts go to `<tree>/_bisect/` (or `--workdir`). Each run `rmtree`s and rebuilds, so repeated runs are idempotent. | The user pushes the fix themselves. Keep the skill's write surface auditable. |
| **H6** | **Never claim the alert is closed.** Only `state` changing, or the alert position moving, proves a rescan — **not** `updated_at` (it refreshes only on state change). | Reporting a false "closed" is worse than reporting nothing. |
| **H7** | **Never treat exit code `2` as "clean".** `2` means input/runtime error (missing path, malformed SARIF, bad `--variant`, `codeql` timeout). Only `0` is clean. | The most dangerous misjudgement: a typo'd path silently reading as "no findings". Fixed in v1.0.2. |

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

This is a duplicate of the same mirror-based curl download pattern. Fetching executable content from a third-party mirror is risky because a substituted archive can deliver malicious code; the surrounding warnings mitigate but do not eliminate the danger, especially in beginner-oriented instructions.

Content

Scanner excerpt · references/running-codeql-cli.md (reported line 155)May include surrounding context.

export HTTPS_PROXY=http://127.0.0.1:7890 gh release download v2.27.1 --repo github/codeql-cli-binaries --pattern "codeql-win64.zip"

方案 C：用 curl 走镜像直接下（不需要 gh）

curl -L -o codeql-win64.zip "https://mirror.example.com/github/codeql-cli-binaries/releases/download/v2.27.1/codeql-win64.zip"

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

This is a duplicate of the same mirror-based curl download pattern. Fetching executable content from a third-party mirror is risky because a substituted archive can deliver malicious code; the surrounding warnings mitigate but do not eliminate the danger, especially in beginner-oriented instructions.

Content

Scanner excerpt · references/running-codeql-cli.md (reported line 155)May include surrounding context.

export HTTPS_PROXY=http://127.0.0.1:7890 gh release download v2.27.1 --repo github/codeql-cli-binaries --pattern "codeql-win64.zip"

方案 C:用 curl 走镜像直接下(不需要 gh)

curl -L -o codeql-win64.zip "https://mirror.example.com/github/codeql-cli-binaries/releases/download/v2.27.1/codeql-win64.zip"

text

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/run_tests.py (reported line 55)May include surrounding context.

python
def _run(script: Path, *args: str, env: dict | None = None) -> subprocess.CompletedProcess:
    # 列表传参、shell=False、执行本仓脚本（本地受信），无外部输入（S5 安全整改）
    run_env = dict(os.environ)
    if env:
        run_env.update(env)
    return subprocess.run([sys.executable, str(script), *args],

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The hard constraint says "Never modify the user's source. Read-only. All artifacts go to /_bisect/", which frames the skill as non-modifying. But elsewhere the document explicitly describes staging variant trees and replacement-based variants under the target tree/workdir, which entails writing derived files and directories based on user source content. While this may avoid editing original files in place, it contradicts the plain-language 'Read-only' claim.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/running-codeql-cli.md (reported line 185)May include surrounding context.

bash
# 有网机器：建库一次，并把查询包落盘带走
codeql database create ./db --language=python --source-root=src --threads=0
codeql database analyze ./db --format=sarif-latest --output=./probe.sarif \
    --download codeql/python-queries:Security/CWE-312/CleartextStorage.ql   # ← 只为把 ~/.codeql/packages 拉下来

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bisect_taint.py (reported line 83)May include surrounding context.

python
print(tr("try_attempt", attempt=attempt, cmd=quoted), flush=True)
        try:
            # 列表传参、shell=False、来源为本地受信的 codeql 路径（S5 安全整改）
            return subprocess.run(cmd, timeout=CODEQL_TIMEOUT, shell=False).returncode
        except subprocess.TimeoutExpired:
            retry = tr("retry_once") if attempt == 1 else tr("retry_giveup")
            print(tr("warn_timeout", timeout=CODEQL_TIMEOUT, retry=retry),

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/run_tests.py (reported line 58)May include surrounding context.

python
run_env = dict(os.environ)
    if env:
        run_env.update(env)
    return subprocess.run([sys.executable, str(script), *args],
                          capture_output=True, text=True, encoding="utf-8",
                          shell=False, env=run_env)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This file hard-codes substantial Chinese-language instructional content in the module docstring alongside English, which imposes a specific locale in user-facing text rather than clearly offering language choice for all displayed guidance. Under the policy, forced or assumed language/locale without explicit opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This file contains natural-language guidance and code that enforce English as the fallback UI language. That can violate a language/locale policy requiring user choice or opt-in, because the script emits a specific language even when no explicit preference was provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The file embeds substantial natural-language guidance in Chinese alongside English, but some operational text and comments elsewhere in the file are Chinese-only. For organizational language policy, forcing or assuming one language without explicit user opt-in can be a policy concern, especially in user-facing strings or instructions.

Content

No source excerpt is available for this finding.