T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:249- Finding
Excessive External Repository Access Through Organization-Wide GitHub App Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Code Reviewer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent code-review automation guide, but it recommends persistent repository access and automated PR approvals that can bypass human review.
Review this carefully before installing. Limit the GitHub App to selected repositories, avoid letting bot approvals satisfy required human or code-owner review, disable or heavily restrict auto-approve, and confirm what repository and PR data is sent to ClawHub or Slack before using it on private or sensitive codebases.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:226- Finding
Automated Pull-Request Approval Can Bypass Required Human Review
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md --- name: code-reviewer description: "Automated code review, quality gates, and PR analysis. Integrates with GitHub, GitLab, Bitbucket. Enforce style guides, detect bugs, security vulnerabilities, performance issues. Auto-approve safe PRs, flag dangerous changes. Save developers 5+ hours/week on manual reviews." homepage: https://clawhub.com/skills/code-reviewer metadata: openclaw:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md --- name: code-reviewer description: "Automated code review, quality gates, and PR analysis. Integrates with GitHub, GitLab, Bitbucket. Enforce style guides, detect bugs, security vulnerabilities, performance issues. Auto-approve safe PRs, flag dangerous changes. Save developers 5+ hours/week on manual reviews." homepage: https://clawhub.com/skills/code-reviewer metadata: openclaw:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md --- name: code-reviewer description: "Automated code review, quality gates, and PR analysis. Integrates with GitHub, GitLab, Bitbucket. Enforce style guides, detect bugs, security vulnerabilities, performance issues. Auto-approve safe PRs, flag dangerous changes. Save developers 5+ hours/week on manual reviews." homepage: https://clawhub.com/skills/code-reviewer metadata: openclaw:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill provides a concrete auto_approve configuration and explicitly notes 'Skip required reviewers,' enabling the system to approve and accelerate merges based on automated checks and simple heuristics such as author membership and file count. In a code-review skill, this is more dangerous because attackers or insiders can craft small but impactful changes that satisfy the heuristic and bypass meaningful human review.
- Content
md on_pr_update: - "review" # Re-review auto_approve: when: - "all_checks_pass == true" - "author in [maintainer_team]"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents installation on repositories and across an organization with pull request write access, but does not warn users about the breadth of access being granted or the consequences of automated review/comment actions. In a code-review automation context, broad installation can expose private source code and enable mass automated actions across many repos if the app is misconfigured or compromised.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The documented webhook configuration transmits repository event data to an external service endpoint at api.clawhub.com. In this skill's context, that likely includes pull request metadata and potentially private repository information, so the lack of a trust boundary warning creates real data exposure risk.
- Content
md # Create GitHub App (one time) clawhub code-reviewer create-app \ --name "Code Reviewer" \ --webhook-url "https://api.clawhub.com/webhooks/github" \ --permissions "contents=read, pull_requests=write" # Install on repositories
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Slack notification example sends PR titles, URLs, and review summaries to an external messaging service without any disclosure about data sharing. This can leak sensitive code-review metadata, security findings, or private repository context into third-party systems and broader internal channels.
- Content