ClawHub
Back to skill

Security audit

C Support Library

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a coherent C-language helper library, with only low-level dependency reproducibility risk noted.

Reasonable to install for C project analysis. For stricter environments, install it in a sandbox and use a lockfile or pinned dependency versions before running automated workflows.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Unpinned Dependencies

Low
Category
Supply Chain
Content
tree-sitter>=0.23.0
tree-sitter-c>=0.23.0
pycparser>=2.22
Confidence
89% confidence
Finding
The dependency is specified with a lower-bound version only, which allows installation of newer, unreviewed releases. This creates supply-chain risk because a future compromised or breaking upstream version could be pulled into the environment without explicit approval or reproducibility guarantees.

Unpinned Dependencies

Low
Category
Supply Chain
Content
tree-sitter>=0.23.0
tree-sitter-c>=0.23.0
pycparser>=2.22
Confidence
89% confidence
Finding
The package is not pinned to a specific version, so builds may resolve to different releases over time. That increases supply-chain exposure and reduces reproducibility, making it easier for a malicious or vulnerable upstream release to enter the project unnoticed.

Unpinned Dependencies

Low
Category
Supply Chain
Content
tree-sitter>=0.23.0
tree-sitter-c>=0.23.0
pycparser>=2.22
Confidence
89% confidence
Finding
Using only a minimum version permits any later release to be installed, including versions not yet assessed by the project. In a security-focused support library, this weakens dependency control and can introduce avoidable supply-chain or compatibility risk.

Static analysis

No suspicious patterns detected.