ClawHub
Back to skill

Security audit

LogicArt Code Review

Security checks for vulnerabilities and agentic risk

Overview

This code-review skill is purpose-aligned but sends user-provided code or entire local files to LogicArt without clear consent, scoping, or sensitive-data safeguards.

Install only if you are comfortable sending selected code to LogicArt. Avoid using --file on confidential repositories, secrets, .env files, private keys, customer data, or regulated code unless you have authorization and understand the provider's retention and privacy terms.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/analyze.mjs:26
Finding

Unrestricted Transmission of Local File Contents to an External Service

Content
View full analysis

Vulnerability Details

File Location: scripts/analyze.mjs:26-40
Vulnerability Type: Uncontrolled disclosure of local source code and potentially sensitive files to a third-party API
Risk Level: High

The documented --file workflow in SKILL.md:15-16 allows a caller to provide a local file path. The implementation reads the entire file and transmits its contents to https://logic.art/api/agent/analyze.

js
if (args.file) {
  code = readFileSync(args.file, 'utf8');
  if (!language) language = EXT_LANG[extname(args.file)] || 'unknown';
}

if (!code) {
  console.error('Usage: analyze.mjs --code <code> | --file <path> [--language <lang>]');
  process.exit(1);
}

const res = await fetch(API, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ code, language: language || 'unknown' }),
});

Technical Analysis

The --file argument accepts any path readable by the process. The script does not restrict the path to the intended project root, validate that the target is an approved source-code file, impose a file-size limit, scan or redact secrets, or require explicit confirmation before external transmission.

After readFileSync() loads the complete file, its contents are placed in the code property of a JSON request and sent to a third-party endpoint. Although the documentation identifies LogicArt as the analysis provider, it does not prominently warn that complete local file contents leave the execution environment. This can result in accidental disclosure when an agent or user supplies a sensitive path while expecting a local code-review operation.

Exploitation does not grant additional operating-system privileges: access remains limited to files readable by the account running the Skill. However, within that boundary, any readable text file may be submitted because extension recognition only controls the language label and doe ...[truncated 1440 chars]

Remediation
View remediation

Remediation Suggestions

  1. Display a clear warning that the complete file will be sent to logic.art, and require explicit confirmation before transmitting file contents.
  2. Provide a deliberate noninteractive consent flag for trusted automation rather than silently transmitting by default.
  3. Resolve and canonicalize the requested path, then require it to remain within an explicitly approved project root.
  4. Permit only expected source-code extensions and reject credential files, private keys, environment files, and other known sensitive formats.
  5. Scan for common secret patterns before transmission. Block the request or redact detected API keys, passwords, access tokens, private keys, and connection strings.
  6. Add configurable file-size and request-size limits to prevent accidental submission of large or unintended files.
  7. Offer a local-only analysis mode for confidential repositories and allow users to review the exact payload before submission.
  8. Document the external service's data-processing, retention, deletion, and privacy policies adjacent to the usage instructions.
  9. Prefer sending explicitly selected snippets instead of complete files whenever full-file context is unnecessary.
  10. Log only metadata needed for diagnostics and ensure source contents or detected secrets are never written to logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill clearly instructs users to invoke a script and call an external API, which implies network-capable behavior, yet it declares no tool scope or permission constraints. That omission increases the chance the skill is invoked with broader-than-necessary capabilities and reduces transparency about outbound data handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases are very broad, covering common requests like 'analyze code', 'find bugs', and 'code quality', which makes accidental or overly frequent invocation likely. In a skill that can transmit user-supplied code to third-party services, overbroad matching increases the risk of unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation repeatedly encourages sending code to external services but does not warn that proprietary, sensitive, or regulated source code may leave the local environment. This is dangerous because users may unknowingly transmit confidential codebases or secrets embedded in source files to third-party endpoints.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The skill includes a concrete example of posting code directly to an external endpoint, which is a real data exfiltration path for any code provided by the user. Even if intended for analysis, transmitting source code to a third party can expose intellectual property, embedded credentials, or internal logic to systems outside the user's control.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Endpoint: POST https://logic.art/api/agent/analyze

bash
curl -s -X POST "https://logic.art/api/agent/analyze" \
  -H "Content-Type: application/json" \
  -d '{"code": "your code here", "language": "javascript"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This script sends user-supplied source code to a third-party remote API at logic.art for analysis, but it provides no explicit user-facing warning, confirmation, or consent step before transmitting potentially sensitive code. In a code-review skill, users may pass proprietary, private, or credential-containing source files, so silent exfiltration to an external service creates a real confidentiality risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.