ClawHub
Back to skill

Security audit

Code Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed code-audit workflow with optional local helper scripts, and I found no hidden persistence, exfiltration, destructive behavior, or purpose-mismatched authority.

Install only if you want an audit workflow that may inspect repository structure, git metadata, selected files/diffs, and available reviewer routes. Before using external model review, check project confidentiality rules and avoid including sensitive diffs unless they are safe to share.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description is for an audit/reviewer skill workflow: it describes when the skill should be invoked and says it reads docs first, inspects code/diffs/tests, and may use a reviewer model/subagent. The supplied code, however, is not an auditing agent or review workflow. It is a helper utility that builds a lightweight repo snapshot: it walks the repository, classifies filenames, reads .auditignore, and runs git status/diff-stat commands. Its primary purpose is context collection for selective later auditing, not performing the audit itself. This is a material description-behavior mismatch because the actual code adds concrete capabilities and resource access (filesystem traversal and git command execution) that are not the core behavior described, while also omitting key declared behaviors such as substantive code/diff/test inspection and reviewer-model selection.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is for an operational code-audit/review skill that analyzes repositories, diffs, tests, and documentation in response to user audit requests. The supplied code does not perform any code audit or security review of target code. Instead, it validates the structure of an evals JSON file and optionally scores previously generated outputs by checking for expected substrings. That is a materially different primary purpose: evaluation tooling for the code-audit skill, not the audit skill itself. There are no dangerous extra permissions or resource accesses, but the behavior is clearly not what the description claims.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents an auditing/review skill with specific usage constraints and analysis behavior. The actual code chunk only launches the project's test suite. That is a materially different primary purpose from performing code or security audits. While test infrastructure can support such a skill, this code itself does not implement the declared audit functionality, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
- Resolve `<skill-dir>` as the directory containing this `SKILL.md`. In this repo it is `.codex/skills/code-audit`.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
- Do not judge code based on which agent produced it. Audit the artifact, the repo contract, and the failure modes.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
90% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/audit-checklist.md (reported line 17)May include surrounding context.

md
## Correctness and Data Integrity

- Writes are transactional where partial failure would corrupt state.
- Migrations/schema setup are compatible with supported deployments.
- State transitions cannot skip review, approval, publication, or provenance steps.
- Retries and duplicate submissions do not duplicate records, facts, jobs, or notifications.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_scripts.py (reported line 25)May include surrounding context.

python
cwd: Optional[Path] = None,
    env: Optional[Dict[str, str]] = None,
):
    merged_env = os.environ.copy()
    merged_env["PYTHONDONTWRITEBYTECODE"] = "1"
    if env:
        merged_env.update(env)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_scripts.py (reported line 94)May include surrounding context.

python
if not git_available():
        return
    subprocess.run(["git", "init"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    secret_file = tmp_path / "secret.txt"
    secret_file.write_text("token=SECRET_VALUE\n", encoding="utf-8")
    subprocess.run(["git", "add", "secret.txt"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    subprocess.run(

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_scripts.py (reported line 96)May include surrounding context.

python
if not git_available():
        return
    subprocess.run(["git", "init"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    secret_file = tmp_path / "secret.txt"
    secret_file.write_text("token=SECRET_VALUE\n", encoding="utf-8")
    subprocess.run(["git", "add", "secret.txt"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    subprocess.run(

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/audit_snapshot.py (reported line 81)May include surrounding context.

python
def run_git(root: Path, args: List[str]) -> Optional[str]:
    try:
        result = subprocess.run(
            ["git", *args],
            cwd=root,
            check=False,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_tests.py (reported line 14)May include surrounding context.

python
def main() -> int:
    skill_dir = Path(__file__).resolve().parents[1]
    basetemp = skill_dir / ".pytest-tmp"
    return subprocess.call(
        [
            sys.executable,
            "-m",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_scripts.py (reported line 29)May include surrounding context.

python
merged_env["PYTHONDONTWRITEBYTECODE"] = "1"
    if env:
        merged_env.update(env)
    return subprocess.run(
        [sys.executable, "-B", str(script), *args],
        cwd=cwd,
        env=merged_env,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_scripts.py (reported line 93)May include surrounding context.

python
def test_build_packet_default_does_not_emit_secret_from_diff(tmp_path: Path) -> None:
    if not git_available():
        return
    subprocess.run(["git", "init"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    secret_file = tmp_path / "secret.txt"
    secret_file.write_text("token=SECRET_VALUE\n", encoding="utf-8")
    subprocess.run(["git", "add", "secret.txt"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_scripts.py (reported line 96)May include surrounding context.

python
subprocess.run(["git", "init"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    secret_file = tmp_path / "secret.txt"
    secret_file.write_text("token=SECRET_VALUE\n", encoding="utf-8")
    subprocess.run(["git", "add", "secret.txt"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    subprocess.run(
        ["git", "-c", "user.email=test@example.com", "-c", "user.name=Test", "commit", "-m", "init"],
        cwd=tmp_path,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_scripts.py (reported line 97)May include surrounding context.

python
secret_file = tmp_path / "secret.txt"
    secret_file.write_text("token=SECRET_VALUE\n", encoding="utf-8")
    subprocess.run(["git", "add", "secret.txt"], cwd=tmp_path, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    subprocess.run(
        ["git", "-c", "user.email=test@example.com", "-c", "user.name=Test", "commit", "-m", "init"],
        cwd=tmp_path,
        check=True,

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This is a JSON manifest-style file, so vague trigger review applies. The phrase "Run a security audit" is broad natural language that overlaps with common user requests and does not specify narrower invocation constraints, examples, or exclusions, which could contribute to unintended activation in systems that use prompt text or descriptions as routing signals.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest describes a skill that reads project docs/code and selects an available reviewer model or subagent when appropriate. This helper goes beyond code/repo inspection by enumerating provider credentials and installed tools from the host environment to discover external review channels, which is a distinct system-discovery capability not evident from the manifest text itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.