ClawHub
Back to skill

Security audit

Code Wiki

Security checks across malware telemetry and agentic risk

Overview

This skill is largely purpose-aligned, but it needs Review because it can process local folders and fetch rendering packages in ways that are not fully scoped in the main skill instructions.

Install only if you are comfortable with the skill cloning or pulling repositories, creating local wiki/site outputs, and optionally downloading Python/Node rendering dependencies. Avoid pointing it at sensitive local folders unless you intend those contents to be processed by CodeWiki, and skip rendering if you do not want runtime package installation.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
for req in REQUIREMENTS:
        print(f"    - {req}")
    try:
        subprocess.run(cmd, check=True)
    except subprocess.CalledProcessError as exc:
        fail(
            f"pip install failed (exit={exc.returncode}). "
Confidence
86% confidence
Finding
The script installs and executes third-party packages from a remote package mirror marked as trusted, which expands the trust boundary to an external repository. In a skill that may process arbitrary repositories, this creates supply-chain risk: a compromised mirror, malicious package, or weakened TLS validation path could result in attacker-controlled code being installed and later executed during mkdocs build.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd.extend(["--site-dir", str(site_dir)])
    print(f"[render_mkdocs] Running: {' '.join(cmd)} (cwd={work})")
    try:
        subprocess.run(cmd, check=True, cwd=str(work))
    except subprocess.CalledProcessError as exc:
        fail(
            f"mkdocs build failed (exit={exc.returncode}). "
Confidence
93% confidence
Finding
Running mkdocs build on untrusted Markdown can execute plugin and extension code inside the created virtual environment. In this script, copied repository content is rendered with MkDocs and extra extensions/plugins enabled, so a malicious documentation tree may trigger unsafe file inclusion or other build-time behaviors, and any compromised dependency executes with the user's local permissions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
87% confidence
Finding
The documented behavior understates what the skill can operate on and what it installs at runtime: accepting local filesystem paths expands access from remote repos to arbitrary local codebases, and installing Python packages from an external mirror introduces supply-chain risk outside the user's explicit expectation. This mismatch is dangerous because users may approve execution thinking it only clones a GitHub repo, while the skill can process sensitive local paths and fetch unpinned third-party code during rendering.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/render_vitepress.mjs:465