ClawHub
Back to skill

Security audit

Forge 🔨 Repair-Inspect Loop

Security checks for vulnerabilities and agentic risk

Overview

Forge is a coherent repair-automation skill, but users should review it carefully because it persists model-generated repair patterns across projects and can automatically run a repository-provided Python checker.

Install only if you are comfortable with an automated repair workflow that writes project state, creates task/result files, may direct agents to edit and test code, and advertises auto-commit behavior. Avoid using it on untrusted repositories unless you disable or remove automatic doc-sync checker execution and isolate or review cross-project reflections before they are reused.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Error
Location
scripts/forge.py:535
Finding

Untrusted Repair Reports Can Poison Cross-Project Agent Memory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/forge.py:836
Finding

Summary Generation Automatically Executes Repository-Controlled Python Code

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
| `status` | Show current progress |
| `check` | Pre-commit safety check (protected files, deletions) |
| `summary` | Generate completion report |
| `reset` | Clear state |

## How It Works

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The protocol explicitly states that a PASS result leads to an automatic commit, but it does not require an explicit user-facing warning or consent before modifying repository history. In this context, the skill is designed to make autonomous code changes, so silent or insufficiently disclosed commit behavior can cause unauthorized state changes, hide risky edits behind automation, and increase operational and supply-chain risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill clearly instructs use of shell execution and project file creation/modification, but it does not declare an explicit tool scope such as allowed tools or permissions. That omission weakens containment and review because an agent may infer broad shell and filesystem authority without user-visible boundaries, which is especially risky in a skill that orchestrates automated repair loops and commits changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises auto-commit behavior on success, but does not give a prominent warning or require explicit consent before creating git commits. In an automated multi-step repair workflow, this can cause repository state changes that users did not intend, potentially persisting faulty or policy-violating changes and complicating rollback or audit trails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The template explicitly requires dynamic validation by actually running code and using real data, but it does not include any safety constraints, sandboxing requirements, or warnings about effects on production systems and sensitive data. In a repair-orchestration skill, this increases the chance that an inspector agent executes untrusted or recently modified code in a live or data-bearing environment, causing data corruption, leakage, or unintended side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructions and operational text are entirely in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. This can violate language/locale policy when a skill imposes a language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger conditions include broad natural-language activations such as user requests to "fix X" / "resolve X", which can cause the skill to launch on ambiguous, everyday phrasing without explicit confirmation of scope. In a skill that performs automated repair loops and can proceed to commits, overbroad activation increases the chance of unintended code modification workflows being started from casual or underspecified requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains user-facing natural-language instructions and CLI messaging entirely in Chinese, including the top-level description and usage guidance. The skill does not indicate that language is configurable or that users may opt into another locale, which can violate a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill persists model-generated repair patterns outside the target workdir into a shared cross-project store and later re-injects them into future repair prompts. That creates a cross-project prompt/data contamination channel where one malicious or sensitive project can influence later runs or leak project-specific knowledge despite the attempted heuristic generalization.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/forge.py (reported line 685)May include surrounding context.

python
try:
        # Get staged changes
        diff_result = subprocess.run(
            ["git", "diff", "--cached", "--name-only"],
            capture_output=True, text=True, cwd=str(workdir)
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/forge.py (reported line 693)May include surrounding context.

python
if not changed:
            # Check unstaged too
            diff_result = subprocess.run(
                ["git", "diff", "--name-only"],
                capture_output=True, text=True, cwd=str(workdir)
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/forge.py (reported line 707)May include surrounding context.

python
result["violations"] = [f"受保护文件被修改: {v}" for v in violations]

        # Check deletions
        del_result = subprocess.run(
            ["git", "diff", "--diff-filter=D", "--name-only"],
            capture_output=True, text=True, cwd=str(workdir)
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/forge.py (reported line 717)May include surrounding context.

python
result["violations"].append(f"文件被删除: {', '.join(deleted)}")

        # Check change size
        stat_result = subprocess.run(
            ["git", "diff", "--stat"],
            capture_output=True, text=True, cwd=str(workdir)
        )

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This logic discovers and runs a repository-local script unrelated to core repair orchestration, effectively granting arbitrary code execution to the analyzed project during a summary/doc-sync step. Because the tool is meant to operate on potentially untrusted codebases, automatically executing helper code from that codebase is especially dangerous in context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

The script executes a project-local helper from the target workdir, which means untrusted repository contents can cause arbitrary code execution when summary/doc-sync checks are run. In a repair orchestrator that may be pointed at many external projects, treating repo-local Python as trusted materially expands the attack surface beyond simple file inspection.

Content

Scanner excerpt · scripts/forge.py (reported line 840)May include surrounding context.

python
checker = workdir / "scripts" / "tools" / "doc-sync-checker.py"
    if checker.exists():
        try:
            result = subprocess.run(
                [sys.executable, str(checker), "--json"],
                capture_output=True, text=True, cwd=str(workdir), timeout=30
            )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill title and multiple operational examples are presented in Chinese, including task descriptions and workflow sections, but the document does not state that language is optional or user-selectable. This can violate language/locale policy when a skill effectively assumes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

All user-facing instructions in the file are in Chinese, and there is no indication that the user can opt into another language or that the locale restriction is intentionally scoped. This can violate language/locale policy when a skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.