ClawHub
Back to skill

Security audit

Secret Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a real local secret scanner, but it needs Review because its install docs run unpinned remote Python and its reports can reveal raw secrets in context lines.

Review before installing. Prefer running the bundled reviewed script instead of the curl command, or pin and verify any remote download. Do not publish CI logs, JSON, or SARIF output from this version unless you have confirmed context redaction is fixed; rotate any real credentials that may have appeared in generated reports. Limit scans to intended project paths and avoid running the auxiliary verifier on untrusted packages without sandboxing.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:34
Finding

Unpinned Remote Python Payload Is Downloaded and Subsequently Executed

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
secret_scanner.py:665
Finding

Secret-Bearing Source Lines Are Exposed in Terminal, JSON, and SARIF Reports

Content
View full analysis
None: """Print findings as JSON array.""" output = [] for f in findings: output.append({ "pattern_id": f.pattern_id, "pattern_name": f.pattern_name, "severity": f.severity, "file": f.file, "line": f.line, "redacted": f.redacted, "context": f.context[:200] if f.context else "", "entropy": round(f.entropy, 2) if f.entropy is not None else None, }) print(json.dumps(output, indent=2)) ``` SARIF output also embeds the unredacted source line: ```python sarif["runs"][0]["results"].append({ "ruleId": f.pattern_id, "message": {"text": f"Found {f.pattern_name} at line {f.line}"}, "level": "error" if f.severity == "critical" else "warning", "locations": [ { "physicalLocation": { "artifactLocation": {"uri": f.file}, "region": { "startLine": f.line, "snippet": {"text": f.context[:20 ...[truncated 2441 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A second independent mismatch report indicates the skill executes compilation checks, self-tests, and deploy-readiness workflows while only performing a narrow hardcoded regex check rather than comprehensive secret detection. In a security-tool context, this is especially risky because teams may integrate it into CI expecting meaningful secret scanning coverage, leaving sensitive credentials undiscovered while arbitrary local code/tests may be executed.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A second independent mismatch report indicates the skill executes compilation checks, self-tests, and deploy-readiness workflows while only performing a narrow hardcoded regex check rather than comprehensive secret detection. In a security-tool context, this is especially risky because teams may integrate it into CI expecting meaningful secret scanning coverage, leaving sensitive credentials undiscovered while arbitrary local code/tests may be executed.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 71)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 119)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 220)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 279)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 303)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 309)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 315)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 345)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 351)May include surrounding context.

python
# ── GitHub ────────────────────────────────────────────────────────────
    {
        "id": "github-pat",
        "name": "GitHub Personal Access Token",
        "severity": "critical",
        "regex": re.compile(r"(?:ghp|gho|ghu|ghs|ghf|ghr)_[A-Za-z0-9]{36,252}"),
    },

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 1074)May include surrounding context.

python
d = tempfile.mkdtemp(prefix="ss_selftest_")
    try:
        # Check AWS key detection
        p = os.path.join(d, "secrets.txt")
        with open(p, "w", encoding="utf-8") as f:
            f.write("# this is for testing\n")
            f.write("aws_key=AKIAIOSFODNN7EXAMPLE\n")

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret_scanner.py (reported line 1124)May include surrounding context.

python
d = tempfile.mkdtemp(prefix="ss_selftest_")
    try:
        # Check AWS key detection
        p = os.path.join(d, "secrets.txt")
        with open(p, "w", encoding="utf-8") as f:
            f.write("# this is for testing\n")
            f.write("aws_key=AKIAIOSFODNN7EXAMPLE\n")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises executable usage (python secret_scanner.py ..., curl -O ...) and the analyzer detected file read, file write, and shell capabilities, but the manifest declares no permissions or allowed-tools scope. That creates an under-specified trust boundary: an agent may run a skill with broader capabilities than a reviewer expects, increasing the chance of unintended command execution or filesystem access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

This helper executes arbitrary Python files found in the target product folder using python <file> self-test. In this verifier's context, the files being checked are untrusted skill contents, so verification triggers attacker-controlled code execution on the CI runner or analyst machine. The explicit subprocess call is not shell-injection vulnerable, but it is still a real arbitrary code execution sink.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python
all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

This code executes any test_*.py or *_test.py found in the target folder. In a skill marketplace or CI verification setting, those tests are attacker-supplied and can run arbitrary code, exfiltrate secrets, modify the workspace, or pivot within CI infrastructure. The skill context makes this more dangerous because the verifier is explicitly intended to inspect potentially untrusted submissions.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python
# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · secret_scanner.py (reported line 9)May include surrounding context.

python
credentials, and private keys using regex patterns and Shannon entropy analysis.

Commands:
  scan <file-or-dir>     Recursively scan files/directories for secrets.
  check <file>           Deep-scan a single file with detailed context.
  list-patterns          List all supported detection patterns.
  self-test              Run built-in self tests.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code performs a file write operation by creating or overwriting the user-specified SARIF output path. While the CLI help mentions an output file, there is no runtime confirmation or explicit user-facing disclosure at the point of write that the target file will be created or replaced.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.