ClawHub
Back to skill

Security audit

graphify

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent knowledge-graph assistant integration, with disclosed indexing, optional LLM use, and user-triggered assistant or git hook setup.

Install in a virtual environment, review the graphify package provenance and version before use, create a .graphifyignore that excludes secrets, and only run URL ingestion or assistant/git hook installation when you intend those project-scoped changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:33
Finding

Unpinned Third-Party Graphify Package Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Lock and review transitive dependencies, not only the direct `graphify` dependency. Regenerate the lock file through a controlled dependency-update process. 4. Install the package inside a dedicated virtual environment using a non-privileged account. Avoid system-wide or administrator-level installation. 5. Verify package provenance, publisher identity, repository ownership, and release signatures or attestations where available. 6. Treat upgrades as security-sensitive changes. Review release differences, update approved hashes, and test the package before changing the pinned version. 7. Limit API credentials supplied to the process and scope them to the minimum necessary permissions and budget. Do not expose unrelated secrets in the installation or execution environment. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · templates/graphifyignore.txt (reported line 96)May include surrounding context.

text
*.trace

# ── Secrets and credentials (never index) ─────────────────────────────────────
.env
.env.*
*.pem
*.key

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The graphify add <url> documentation instructs users to fetch and index arbitrary external URLs, including social media and video sites, but does not clearly warn that this triggers outbound network requests and ingestion of untrusted remote content. In an AI-assistant skill context, this is more dangerous because it normalizes pulling attacker-controlled content into the toolchain, which can expose metadata, process malicious prompt content, or surprise users operating in restricted or sensitive environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.