Security audit
Security checks for vulnerabilities and agentic risk
ClawScan’s verdict is benign with medium confidence: the reported concerns relate mainly to declared health-check behavior that appears to include repository changes or checks the scanners could not fully verify.
The benign verdict is not a guarantee of safety, and scan coverage was partial: 22 of 23 components were scanned, one file was only partially inspected, and some referenced files were missing from the bundle. Before installing, consider whether you want a skill that may change repository hook configuration and request adapter repair; the scan could not confirm the effects of the repair script or hook contents.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
这个 Skill 的安全要求是行为约束，不是建议：
1. 保留底层命令的真实退出码，不用管道吞错；
2. 不使用 `git commit --no-verify` 或其他方式绕过验证；
3. 不修改测试计数、删除反例、降低 `failClosed` 或放宽危险动作规则来制造通过；
4. 不未经用户明确要求运行适配链接 `--fix` 或修复代码；
5. 不把执行者自报完成当成独立证据；
The supplied chunk only initializes browser-global data. It does not invoke verify.sh, inspect referenced files, evaluate hooks or safety gates, or check Episode state. Command strings and evidence paths are inert report fields, not executable checks. This dataset could support a broader auditing tool, but the supplied code alone does not implement the declared auditing behavior. No network access, filesystem access, or command execution is shown.
Although hooks are within the declared subject area, installing or activating them changes future Git behavior and is materially different from inspecting them. This configuration-changing capability is not disclosed by the health-check description. The script does not itself execute any hook, and the contents of those hooks are not shown.
The supplied command requests a fix operation for agent adapters, whereas the declared purpose describes verification and health checks. This is a meaningful check-versus-repair discrepancy, not merely a different implementation of a check. No invocation of verify.sh or the other stated checks is visible; the missing script body limits certainty about downstream behavior.
The skill uses 'file_write' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def git_state(root: Path) -> dict[str, Any]:
def run(args: list[str]) -> str:
result = subprocess.run(args, cwd=root, text=True, capture_output=True, check=False)
return result.stdout.strip()
top = run(["git", "rev-parse", "--show-toplevel"])
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
}[mode]
script_name = next((name for name in candidates if name in package_scripts), None)
if not script_name:
return {"mode": mode, "command": "", "executed": False, "reason": "no verification entrypoint"}
command = f"pnpm run {script_name}"
argv = ["pnpm", "run", script_name]
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
chunks: list[str] = []
last_activity = "starting verification…"
try:
process = subprocess.Popen(
argv,
cwd=root,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
exit_code = 126
else:
try:
result = subprocess.run(argv, cwd=root, text=True, capture_output=True, check=False, timeout=900)
output = f"{result.stdout}\n{result.stderr}"
exit_code = result.returncode
except subprocess.TimeoutExpired as error:
The manifest describes a Harness health check, including Hook checks. L5 persistently sets the repository's core.hooksPath to .githooks, replacing any existing setting and changing which hooks Git will execute; this is configuration mutation rather than validation.