ClawHub
Back to skill

Security audit

Code Review Inspector

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only code review skill whose flagged content is security-example material, not executable or hidden behavior.

Install only if you are comfortable with the agent reading the code you ask it to review, including possible secrets that appear in source or diffs. Treat its findings as review suggestions and verify critical security claims with tests or human review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```python
import os
filename = request.args.get('file')
os.system(f'cat {filename}')  # Attack: file=test.txt; rm -rf /
```

✅ **Secure**:
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High
Category
Tool Misuse
Content
```python
import os
filename = request.args.get('file')
os.system(f'cat {filename}')  # Attack: file=test.txt; rm -rf /
```

✅ **Secure**:
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High
Category
YARA Match
Content
me: { $gt: "" } } returns all users
```

✅ **Secure**:
```javascript
const username = String(req.body.username);
if (!/^[a-zA-Z0-9_]+$/.test(username)) {
  throw new Error('Invalid username');
}
db.users.find({ username });
```

---

#### Command Injection [CWE-78]

❌ **Vulnerable**:
```python
import os
filename = request.args.get('file')
os.system(f'cat {filename}')  # Attack: file=test.txt; rm -rf /
```

✅ **Secure**:
```python
import subprocess
filename = sanitize_filename(request.args.get('file'))
subprocess.run(['cat', filename], check=True)
```

---

#### XSS (Cross-Site Scripting) [CWE-79]

❌ **Vulnerable**:
```javascript
document.getElementById('output').innerHTML = userInput;
// Attack: <script>steal_cookies()</script>
```

✅ **Secure**:
```javascript
document.getElementById('output').textContent = userInput;
// Or use framework escaping (React, Vue auto-escape)
```

---

### Authentication & Authorization

#### Missing Authentication

❌ **Missing**:
```javascript
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Unvalidated Output Injection

High
Category
Output Handling
Content
**Fix**:
   ```javascript
   const sql = 'SELECT * FROM users WHERE name LIKE ?';
   db.query(sql, [`%${query}%`], (err, results) => { ... });
   ```

2. **Information Disclosure** (Line 8)
Confidence
85% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Static analysis

No suspicious patterns detected.