Security audit

Agent Hush

Security checks for vulnerabilities and agentic risk

Overview

This is a local privacy scanner, but it asks agents to scan workspaces silently and includes under-scoped file-changing and deletion-capable commands.

Install only after deciding you are comfortable with silent local scanning of workspaces. Prefer explicit scans of the exact files being pushed or published, avoid heartbeat/background scans, review any .sanitize.json allowlist changes, and do not use export --force on an existing directory unless the destination is disposable and outside the source tree.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:45
Finding: Silent Periodic Scanning Exceeds the Minimum Scope Required for Outbound Protection
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 45-51
Vulnerability Type: Excessive filesystem access and background inspection
Risk Level: Medium

Vulnerable Code Snippet

markdown
### ℹ️ SHOULD check in background: **4. Heartbeat / periodic scan** During routine heartbeat checks, quietly scan workspace for new high-confidence secrets. Don't interrupt the user unless something critical is found. ```bash python3 SKILL_DIR/scripts/sanitize.py check [workspace] --severity critical --quiet

text
### Technical Analysis The Skill's primary declared purpose is to inspect data before an outbound operation such as a Git push, Skill publication, synchronization, or file share. However, these instructions additionally direct the Agent to recursively inspect the workspace during routine heartbeat activity, even when no outbound action is pending and the user has not explicitly requested a privacy scan. The scan implementation recursively reads eligible text files beneath the supplied workspace. Project documentation expressly anticipates scanning sensitive Agent files such as `MEMORY.md` and `TOOLS.md`. Consequently, activating this background behavior grants the Skill broader read access than is necessary to inspect the specific files involved in an outbound operation. The scan remains local, and the audit found no HTTP client, socket operation, telemetry, or other code that transmits scan content. The concern is therefore excessive and silent local access rather than credential exfiltration. ### Attack Path 1. The Skill is installed and its instructions become available to the Agent. 2. A routine heartbeat occurs without a related push, publication, or file-sharing request. 3. The Agent follows the instruction to invoke `sanitize.py check` against the whole workspace. 4. The scanner recursively opens eligible files, potentially including Agent memory, configuration, and operational notes. 5. Detected data is retained in process mem ...[truncated 702 chars]
Remediation: View remediation
Remediation Suggestions

Disable heartbeat and periodic workspace scanning by default.

Require explicit, informed opt-in before enabling recurring scans.

Limit automatic outbound checks to the exact staged files, publication directory, or files selected for sharing.

Exclude Agent memory and state files such as MEMORY.md, TOOLS.md, conversation records, and credential stores unless the user explicitly includes them.

Present the resolved scan scope before the first recurring scan and provide a straightforward way to revoke authorization.

Store an approved path allowlist and reject scans outside those paths.

Preserve local-only processing and ensure reports continue to mask matched values.

T08 · Insecure Dependencies

Warning

Location: docs/install.md:10
Finding: Installation Guide Uses an Unpinned Global npm Package
Content: View full analysis
Vulnerability Details

File Location: docs/install.md, lines 10-14
Vulnerability Type: Mutable third-party dependency installed globally
Risk Level: Medium

Vulnerable Code Snippet

markdown
如果 `clawhub` 未安装，先执行： ```bash npm install -g clawhub

text
### Technical Analysis The installation guide instructs users to install the latest available `clawhub` package globally without pinning a reviewed version or verifying package integrity. The effective installed code can therefore change after this Skill has been audited. npm packages may define lifecycle scripts that execute during installation. A global installation can write to globally configured npm locations and executes with the permissions of the invoking user. If users employ an elevated shell to satisfy global installation permissions, the potential impact increases to system-wide modification. The audit did not establish that the current `clawhub` package is malicious. The vulnerability is the unsafe, mutable dependency acquisition process and the absence of publisher, version, and integrity constraints. ### Attack Path 1. An attacker compromises the package publisher account, registry account, or package release pipeline. 2. The attacker publishes a malicious version under the expected package name. 3. A user follows the guide and runs `npm install -g clawhub`. 4. npm resolves the mutable latest release instead of a version reviewed with this Skill. 5. Malicious package files or lifecycle scripts execute with the user's installation privileges. 6. The package may modify global tools, read accessible credentials, or establish additional execution mechanisms. ### Impact Assessment A compromised dependency could execute arbitrary code with the privileges of the account running npm. It could read user-accessible files and environment variables, modify global npm binaries, alter development tooling, or install persistence where account permissions permit. If installation is ...[truncated 178 chars]
Remediation: View remediation
Remediation Suggestions

Pin the dependency to a specifically reviewed version, for example clawhub@X.Y.Z.

Document the expected official npm registry, package publisher, and provenance.

Provide and verify an integrity hash or signed release artifact where supported.

Avoid global installation when possible; prefer a project-local dependency or a trusted, version-pinned runner.

Instruct users not to run the installation with sudo or administrative privileges.

Review package lifecycle scripts before recommending the dependency.

Pin the raw GitHub installation-document link to an immutable commit rather than the mutable main branch.

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sanitize.py:1578
Finding: Forced Export Can Recursively Delete the Source or an Arbitrary Existing Directory
Content: View full analysis
Vulnerability Details

File Location: scripts/sanitize.py, lines 1578-1607
Vulnerability Type: Unsafe recursive deletion caused by missing path-relationship validation
Risk Level: High

Vulnerable Code Snippet

python
def cmd_export(args): """Create a sanitized copy of a directory for safe publishing.""" src_path = os.path.abspath(args.source) dest_path = os.path.abspath(args.dest) if not os.path.isdir(src_path): print(f"Error: Source {src_path} is not a directory", file=sys.stderr) return 1 if os.path.exists(dest_path) and not args.force: print(f"Error: Destination {dest_path} already exists. Use --force to overwrite.", file=sys.stderr) return 1 config = load_config(src_path) rules = build_rules(config) allowlist = set(config['allowlist']) aggressive = getattr(args, 'aggressive', False) # Copy directory if os.path.exists(dest_path): shutil.rmtree(dest_path) mode_label = "Aggressive" if aggressive else "Conservative (default)" print(f" 📦 Creating sanitized copy — {mode_label} mode") print(f" Source: {src_path}") print(f" Destination: {dest_path}") if not aggressive: print(f" ℹ️ Only replacing high-confidence matches. Use --aggressive for all.") print() shutil.copytree(src_path, dest_path, ignore=shutil.ignore_patterns('.git', '.bak_sanitize', '__pycache__'))

Technical Analysis

The export operation converts source and destination arguments to absolute paths but does not compare their canonical identities or relationships. When --force is supplied and the destination exists, the destination is unconditionally passed to shutil.rmtree().

If source and destination resolve to the same directory, rmtree() deletes the source before copytree() runs. The subsequent copy fails because its source no longer exists. A mistakenly supplied destination can likewise cause recur ...[truncated 1532 chars]
Remediation: View remediation
Remediation Suggestions

Resolve source and destination with Path.resolve() or os.path.realpath() before performing any destructive operation.

Reject destinations that are equal to the source, ancestors of the source, or descendants of the source.

Refuse to recursively delete a destination unless it contains a tool-specific ownership marker proving that it was created by a prior export.

Require a separate explicit confirmation for deletion of a non-empty destination.

Create the export in a newly allocated temporary sibling directory and atomically rename it only after copying and sanitization succeed.

Preserve or move the previous destination to a recoverable backup until the new export completes.

Add regression tests for equal paths, symbolic-link aliases, parent/child paths, filesystem roots, and existing non-tool-owned destinations.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/sanitize.py:1009
Finding: Repository-Controlled Custom Regular Expressions Can Cause Denial of Service
Content: View full analysis
Vulnerability Details

File Location: scripts/sanitize.py, lines 1009-1043, 1124-1136, and 1186-1190
Vulnerability Type: Untrusted regular expression execution without complexity or time limits
Risk Level: Medium

Vulnerable Code Snippet

python
def load_config(base_path): """Load .sanitize.json config if it exists.""" # Search up from base_path to find config search = Path(base_path).resolve() config_data = None for _ in range(10): candidate = search / '.sanitize.json' if candidate.exists(): try: with open(candidate, 'r') as f: config_data = json.load(f) except Exception as e: print(f"Warning: Failed to load {candidate}: {e}", file=sys.stderr) break parent = search.parent if parent == search: break search = parent config = { 'exclude_dirs': list(DEFAULT_EXCLUDE_DIRS), 'exclude_files': list(DEFAULT_EXCLUDE_FILES), 'allowlist': list(DEFAULT_ALLOWLIST), 'custom_secrets': [], 'max_file_size_kb': MAX_FILE_SIZE_KB, } if config_data: if 'exclude_dirs' in config_data: config['exclude_dirs'] = list(set(config['exclude_dirs']) | set(config_data['exclude_dirs'])) if 'exclude_files' in config_data: config['exclude_files'] = list(set(config['exclude_files']) | set(config_data['exclude_files'])) if 'allowlist' in config_data: config['allowlist'] = list(set(config['allowlist']) | set(config_data['allowlist'])) if 'custom_secrets' in config_data: config['custom_secrets'] = config_data['custom_secrets'] if 'max_file_size_kb' in config_data: config['max_file_size_kb'] = config_data['max_file_size_kb'] return config

python
def scan_file(filepath, rules, allowlist): """Scan a single file and return list of findings.""" findings ...[truncated 2837 chars]
Remediation: View remediation
Remediation Suggestions

Do not automatically trust custom_secrets from repositories or parent directories.

Require explicit user approval before enabling custom patterns from a new project.

Stop searching parent directories at a defined workspace boundary.

Prefer a regular expression engine with guaranteed linear-time behavior.

If the current engine must be retained, execute custom matches in an isolated worker with strict per-pattern and per-file timeouts.

Restrict expression length, nesting, ambiguous repetitions, backreferences, and other high-risk constructs.

Compile and validate every expression when loading configuration, and reject malformed patterns with a clear error.

Bound line length or scan long inputs in limited chunks.

Limit the number of custom patterns and total matching operations.

Add tests using known catastrophic-backtracking expressions and adversarial input lines.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (72)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 27)May include surrounding context.
md
- 🏠 "Sync my workspace" → MEMORY.md contains your **real name, phone number, server IP** — now public - 🔐 "Publish this Skill" → Forgot there's a **database connection string with credentials** in the directory - 📁 "Share this project" → File paths reveal your **username and system structure** - 🗝️ "Commit this" → .env wasn't in .gitignore, **Discord Bot Token went straight into git history** **This happens every day.** Thousands of secrets are accidentally committed to GitHub daily.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README_EN.md (reported line 27)May include surrounding context.
md
- 🏠 "Sync my workspace" → MEMORY.md contains your **real name, phone number, server IP** — now public - 🔐 "Publish this Skill" → Forgot there's a **database connection string with credentials** in the directory - 📁 "Share this project" → File paths reveal your **username and system structure** - 🗝️ "Commit this" → .env wasn't in .gitignore, **Discord Bot Token went straight into git history** **This happens every day.** Thousands of secrets are accidentally committed to GitHub daily.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior extends beyond passive privacy checking into modifying files in place, exporting rewritten copies, and editing allowlists, yet it is presented as an invisible privacy guard. That discrepancy can lead to unexpected local changes and overly broad trust in the skill, especially if agents act autonomously based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior extends beyond passive privacy checking into modifying files in place, exporting rewritten copies, and editing allowlists, yet it is presented as an invisible privacy guard. That discrepancy can lead to unexpected local changes and overly broad trust in the skill, especially if agents act autonomously based on the description.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation scope is extremely broad, covering essentially any outbound action plus generic privacy-related prompts. In practice this can cause the agent to trigger frequently and inspect unrelated workspaces or content without a clear boundary, creating privacy, surprise, and overreach risks.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to act as a silent interceptor that users should not notice. Hidden autonomous interception is risky because it normalizes covert inspection and decision-making around user files and outbound actions without informed consent or auditability.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 78% confidence
Finding: The skill directs the agent to pass variable path parameters such as [repo_path], [skill_directory], and [workspace] into shell commands. Without strict validation and quoting rules, this pattern can enable tool-parameter abuse such as scanning unintended directories, acting on attacker-controlled paths, or causing destructive follow-on actions against the wrong target.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
### 🚨 MUST check before these actions: **1. Git push / sync / upload** When the user says anything like: - "帮我推代码" / "同步到 GitHub" / "git push" / "push 一下" - "帮我同步" / "上传代码" / "commit and push"

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/convert_gitleaks.py (reported line 68)May include surrounding context.
python
if current_rule and 'regex' in current_rule: rules.append(current_rule) return rules def go_regex_to_python(pattern):

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/sanitize.py (reported line 1191)May include surrounding context.
python
if current_rule and 'regex' in current_rule: rules.append(current_rule) return rules def go_regex_to_python(pattern):

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The inline documentation says the tool only catches sensitive data before it leaves the machine and that local files remain untouched, yet later functions write backups, rewrite files, delete destinations, and create config files. That contradiction is dangerous in an agent context because users may authorize the skill expecting passive inspection while it performs persistent filesystem changes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The banner text claims local files stay untouched, but the code includes cmd_fix that overwrites files in place and cmd_allow/cmd_init that writes configuration files. In a 'silent' privacy guard that auto-intercepts outbound actions, this mismatch can mislead users and cause unexpected local modification of workspace contents.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 167)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 175)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 179)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 195)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 203)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 207)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 227)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 243)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 247)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 267)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 271)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 283)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 299)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/sanitize.py (reported line 303)May include surrounding context.
python
r'''\b(v1\.0-[a-f0-9]{24}-[a-f0-9]{146})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CLOUDFLARE_ORIGIN_CA_KEY]"), ("Pattern resembling a Codecov Access Token", CRITICAL, HIGH_CONF, r'''(?i)[\w.-]{0,50}?(?:codecov)(?:[ \t\w.-]{0,20})[\s'"]{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\x60'"\s=]{0,5}([a-z0-9]{32})(?:[\x60'"\s;]|\\[nr]|$)''', "[REDACTED_CODECOV_ACCESS_TOKEN]"),

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code Snippet

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code Snippet

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code Snippet

Remediation Suggestions

SkillSpector

Credential Access

Credential Access

Tp4

Tp4

Vague Triggers

Vague Triggers

Tool Parameter Abuse

Direct Prompt Extraction

Direct Prompt Extraction

Intent-Code Divergence

Description-Behavior Mismatch

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis