ClawHub
Back to skill

Security audit

Project Engineering

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent software-engineering workflow with a disclosed read-only repository inventory helper and clear limits around writes, secrets, external systems, and sharing.

Install only if you want a coding agent to inspect repository structure and guide architecture, implementation, review, and delivery work. The bundled inventory script is read-only and avoids secret values, but its output can include repository paths, branch/commit metadata, and structural filenames, so review reports before sharing them outside your organization.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Yes, this is a mismatch. The declared description says the skill helps with software project engineering work such as designing architecture, establishing engineering baselines, and understanding existing codebases for development/refactoring/review/delivery tasks. But the actual code chunk does not perform any of those functions. Instead, it runs unit tests against the skill package itself, validating markdown frontmatter, required references, and documentation wording/content. That is a documentation/package QA utility, not an implementation of project-engineering analysis or guidance. No notable sensitive resource access is present beyond local files, but the primary behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
`{baseDir}` 表示当前 Skill 根目录；不支持该占位符的客户端应解析为当前 `SKILL.md` 所在目录。脚本需要 Python 3.10 或更高版本，只发现事实线索，不替代对源码、构建清单、数据库、测试和文档的核实。

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/project_inventory.py (reported line 112)May include surrounding context.

python
def run_git(root: Path, arguments: list[str]) -> tuple[int, bytes]:
    environment = os.environ.copy()
    environment["GIT_OPTIONAL_LOCKS"] = "0"
    try:
        completed = subprocess.run(

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/project_inventory.py (reported line 706)May include surrounding context.

python
return "environment-file"
    if Path(name).suffix in {".pem", ".key", ".p12", ".pfx", ".jks", ".keystore"}:
        return "key-or-keystore"
    if name in {"id_rsa", "id_ed25519", "credentials", "credentials.json", ".npmrc", ".pypirc"}:
        return "credential-file"
    return None

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/project_inventory.py (reported line 706)May include surrounding context.

python
return "environment-file"
    if Path(name).suffix in {".pem", ".key", ".p12", ".pfx", ".jks", ".keystore"}:
        return "key-or-keystore"
    if name in {"id_rsa", "id_ed25519", "credentials", "credentials.json", ".npmrc", ".pypirc"}:
        return "credential-file"
    return None

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/project_inventory.py (reported line 702)May include surrounding context.

python
with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            self.write(root, "package.json", json.dumps({"scripts": {"leak": sentinel}}))
            self.write(root, ".env", f"TOKEN={sentinel}\n")
            self.run_git(root, "init")
            self.run_git(root, "config", "user.email", "fixture@example.invalid")
            self.run_git(root, "config", "user.name", "Fixture")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_project_inventory.py (reported line 88)May include surrounding context.

python
with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            self.write(root, "package.json", json.dumps({"scripts": {"leak": sentinel}}))
            self.write(root, ".env", f"TOKEN={sentinel}\n")
            self.run_git(root, "init")
            self.run_git(root, "config", "user.email", "fixture@example.invalid")
            self.run_git(root, "config", "user.name", "Fixture")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_project_inventory.py (reported line 92)May include surrounding context.

python
with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            self.write(root, "package.json", json.dumps({"scripts": {"leak": sentinel}}))
            self.write(root, ".env", f"TOKEN={sentinel}\n")
            self.run_git(root, "init")
            self.run_git(root, "config", "user.email", "fixture@example.invalid")
            self.run_git(root, "config", "user.name", "Fixture")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_project_inventory.py (reported line 100)May include surrounding context.

python
with tempfile.TemporaryDirectory() as directory:
            root = Path(directory)
            self.write(root, "package.json", json.dumps({"scripts": {"leak": sentinel}}))
            self.write(root, ".env", f"TOKEN={sentinel}\n")
            self.run_git(root, "init")
            self.run_git(root, "config", "user.email", "fixture@example.invalid")
            self.run_git(root, "config", "user.name", "Fixture")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The contributing guidance is written entirely in Chinese, which effectively forces a specific language for contributors. Under the stated policy, language constraints should either be optional for users or explicitly justified as region-specific; neither is present here.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill instructs the agent to use shell, file reads, and file writes, but it does not declare an explicit tool/permission scope. That creates an authorization ambiguity where a host agent may expose broader capabilities than intended, increasing the chance of unnecessary filesystem or command execution during repository analysis.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file contains all user-facing guidance in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file is entirely written in Chinese and does not indicate that language choice is optional or that the skill is intended only for a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring is written as a hard requirement in Chinese, indicating the skill's behavior and user-facing description are localized to a specific language. The CLI help text and error messages elsewhere in the file are also Chinese-only, with no option to choose another language, which violates the language/locale policy criterion when no user opt-in is offered.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/project_inventory.py (reported line 115)May include surrounding context.

python
environment = os.environ.copy()
    environment["GIT_OPTIONAL_LOCKS"] = "0"
    try:
        completed = subprocess.run(
            ["git", "--no-pager", "-c", "core.fsmonitor=false", "-C", str(root), *arguments],
            stdout=subprocess.PIPE,
            stderr=subprocess.DEVNULL,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The command description, argument help text, and validation error are all presented only in Chinese, which imposes a specific language on users. Because the skill does not offer a locale flag, environment-based selection, or documented opt-in, this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_project_inventory.py (reported line 118)May include surrounding context.

python
self.assertNotIn(sentinel, json.dumps(inventory, ensure_ascii=False))

    def run_git(self, root: Path, *arguments: str) -> None:
        completed = subprocess.run(
            ["git", "-C", str(root), *arguments],
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text
permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF
CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains all substantive policy instructions in Chinese, including vulnerability reporting and trust-model guidance. Under the policy rule, forcing a specific language without user opt-in or justification can be a natural-language policy violation because users who do not read Chinese may miss critical security instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The prominent user-facing tagline at L10 is written only in Chinese, which can be read as a locale-specific constraint for users who do not read that language. Although L16 later states replies should use the user's current language, this line itself does not offer a language choice or bilingual alternative.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill document is written only in Chinese, with no indication that another language can be used or that the locale is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code contains user-facing natural-language strings only in Chinese, including the module docstring and a test failure message. Per the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.