Skill Lifecycle

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:48 AM UTC
• Version: 0.2.0

Overview

This skill is a plausible lifecycle automation tool, but its release workflow can publish after failed checks and its normal Git flow can commit unrelated or sensitive files.

Review carefully before installing. Use this only in disposable or well-controlled repositories, prefer dry-run first, inspect git status before any workflow, avoid running full publishing until the release-gate bug is fixed, and pin dependencies in an isolated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: commands/dev_flow.py:67

Finding

Failed tests or security scans do not prevent publication

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: commands/git_ops.py:59

Finding

Automatic blanket Git staging can commit unrelated or sensitive files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: commands/quality.py:50

Finding

Security scanner ignores nested and non-Python content while reporting success

Content

View full analysis

list: """Check sensitive information.""" issues = [] patterns = [ (r'sk[a-zA-Z0-9_-]{20,}', 'API key'), (r'password\s*=\s*["\'][^"\']+["\']', 'hardcoded password'), (r'secret\s*=\s*["\'][^"\']+["\']', 'hardcoded secret'), (r'api_key\s*=\s*["\'][^"\']+["\']', 'hardcoded API key'), ] for py_file in skill_dir.glob('*.py'): content = py_file.read_text(encoding='utf-8') lines = content.split('\n') for i, line in enumerate(lines, 1): for pattern, desc in patterns: if re.search(pattern, line, re.IGNORECASE): issues.append(Issue( py_file.name, i, 'sensitive_data', f'Possible {desc}', 'error' )) return issues ``` ```python issues = check_sensitive_data(skill_dir) if issues: for issue in issues: console.print( f" [red]Failure[/red] " f"{issue.file}:{issue.line} - {issue.message}" ) else: console.print(" [green]No security issues found[/green]") ``` The docstrings and display text above are translated into English; the traversal and matching logic are unchanged. ### Technical Analysis The scanner uses `skill_dir.glob('*.py')`, which only inspects Python files immediately inside the supplied directory. It does not recursively inspect nested modules such as `commands/*.py`. It also omits shell scripts, JavaScript, configuration files, environment files, private keys, and other content that can contain executable code or secrets. The same top-level-only traversal pattern appears throughout the enhanced checks in `commands/quality_rules.py`. D ...[truncated 1119 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:2

Finding

Open-ended dependency versions prevent reproducible, integrity-verified installation

Content

View full analysis

=8.0.0 semver>=3.0.0 rich>=13.0.0 pyyaml>=6.0.0 ``` ```bash pip install -r requirements.txt ``` ### Technical Analysis All third-party requirements use open-ended minimum-version constraints. A future version satisfying the lower bound can therefore be installed without review. The project provides no lockfile and no cryptographic hashes to bind installation to known artifacts. The listed package names appear legitimate, and the audit found no evidence of typosquatting, dependency confusion, or a currently malicious package. The risk arises from non-reproducible resolution and lack of artifact integrity pinning. ### Attack Path 1. A user follows the documented installation command. 2. The package index resolves each requirement to a currently available version satisfying the open-ended constraint. 3. A compromised, malicious, or unexpectedly incompatible future release satisfies that constraint. 4. `pip` downloads and installs the release without comparison to a reviewed lockfile or expected hash. 5. Package installation or later import executes the affected dependency code under the user’s account. ### Impact Assessment Dependency installation and imports execute with the privileges of the user running `pip` or the lifecycle tool. A compromised dependency could potentially read or modify files available to that user, access environment credentials, or tamper with lifecycle operations. The practical scope depends on the installation environment and whether installation occurs in an isolated virtual environment. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description claims a broad end-to-end lifecycle tool covering versioning, testing, quality scanning, Git submission, and optional publishing/knowledge extraction. However, this code chunk only provides a CLI for configuration file management. It reads/writes YAML config files, validates required keys, shows config values, and attempts to open the config in an editor. While these settings reference versioning, scan, test, git, and publish options, the code does not actually execute those workflows. This is therefore a material description-to-behavior mismatch: the actual primary behavior is config management, which is only a supporting subset of the declared lifecycle tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code substantially matches the declared core workflow: version management, testing, quality scan, and Git commit are all implemented, and optional ClawHub publishing is also present in full_flow. However, the declaration also claims an optional '知识提炼' (knowledge extraction) capability, which is not implemented anywhere in the provided code. Additionally, while the description presents a full lifecycle management tool, this file's default executable entrypoint runs only the development flow without publishing; the full flow exists but is a separate command. This is a partial mismatch rather than a complete one, because most of the declared functionality is represented.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · commands/batch.py (reported line 48)May include surrounding context.

python

@click.command()
@click.argument('skill_dir', default='.', type=click.Path(exists=True))
@click.option('--bump', type=click.Choice(['major', 'minor', 'patch']), help='版本升级类型')
@click.option('--skip-test', is_flag=True, help='跳过测试')
@click.option('--skip-scan', is_flag=True, help='跳过质量扫描')
@click.option('--dry-run', is_flag=True, help='预览不执行')
def dev_flow(skill_dir, bump, skip_test, skip_scan, dry_run):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · commands/dev_flow.py (reported line 23)May include surrounding context.

python

@click.command()
@click.argument('skill_dir', default='.', type=click.Path(exists=True))
@click.option('--bump', type=click.Choice(['major', 'minor', 'patch']), help='版本升级类型')
@click.option('--skip-test', is_flag=True, help='跳过测试')
@click.option('--skip-scan', is_flag=True, help='跳过质量扫描')
@click.option('--dry-run', is_flag=True, help='预览不执行')
def dev_flow(skill_dir, bump, skip_test, skip_scan, dry_run):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · commands/dev_flow.py (reported line 59)May include surrounding context.

python

@click.command()
@click.argument('skill_dir', default='.', type=click.Path(exists=True))
@click.option('--bump', type=click.Choice(['major', 'minor', 'patch']), help='版本升级类型')
@click.option('--skip-test', is_flag=True, help='跳过测试')
@click.option('--skip-scan', is_flag=True, help='跳过质量扫描')
@click.option('--dry-run', is_flag=True, help='预览不执行')
def dev_flow(skill_dir, bump, skip_test, skip_scan, dry_run):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · commands/dev_flow.py (reported line 132)May include surrounding context.

python

@click.command()
@click.argument('skill_dir', default='.', type=click.Path(exists=True))
@click.option('--bump', type=click.Choice(['major', 'minor', 'patch']), help='版本升级类型')
@click.option('--skip-test', is_flag=True, help='跳过测试')
@click.option('--skip-scan', is_flag=True, help='跳过质量扫描')
@click.option('--dry-run', is_flag=True, help='预览不执行')
def dev_flow(skill_dir, bump, skip_test, skip_scan, dry_run):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and demonstrates shell execution plus file read/write behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens containment and review because an invoking agent may grant broader capabilities than users expect, especially for commands that modify repositories and local files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Broad trigger phrases increase the chance that the skill is invoked unintentionally in conversations about generic lifecycle, automation, or version-management topics. Because this skill can lead to shell commands, file changes, Git commits, and optional publishing, accidental invocation could cause unintended state changes or nudge an agent toward risky actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented scenarios encourage development and release workflows but do not warn users that Git operations and publishing can change external state. In a lifecycle automation context, missing warnings are especially risky because users may treat the skill as a harmless helper while it can commit code or publish artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file's user-facing natural language strings, including the top-level docstring and command/help text, are entirely in Chinese, with no indication that language is selectable or that the tool is intentionally region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains docstrings, prompts, and console output in Chinese only, including confirmation and error messages. Under the language/locale policy rule, forcing a single language without user opt-in is a natural-language policy concern unless the tool is clearly documented as region-specific, which is not evident in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

At L133 the comment says the code will use the default editor, and L135's inline comment says it is obtaining the system default editor. In reality, subprocess._optim_args_from_interpreter_flags() returns interpreter optimization flags, not an editor command, so the documented intent directly contradicts the actual behavior of the code.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/config.py (reported line 138)May include surrounding context.

python

editor = subprocess._optim_args_from_interpreter_flags()  # 获取系统默认编辑器
    
    try:
        subprocess.run([editor, str(config_path)])
        console.print("[green]✅ 配置已保存[/green]")
    except Exception as e:
        console.print(f"[red]❌ 编辑失败：{e}[/red]")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's docstrings, CLI help text, and runtime console messages are written exclusively in Chinese, which imposes a specific language on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/git_ops.py (reported line 24)May include surrounding context.

python

# 检查是否在 Git 仓库中
    try:
        result = subprocess.run(
            ['git', 'rev-parse', '--git-dir'],
            cwd=skill_dir,
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/dev_flow.py (reported line 97)May include surrounding context.

python

# 显示变更
    console.print("\n[bold]待提交的变更:[/bold]")
    result = subprocess.run(
        ['git', 'status', '--short'],
        cwd=skill_dir,
        capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/git_ops.py (reported line 41)May include surrounding context.

python

# 显示变更
    console.print("\n[bold]待提交的变更:[/bold]")
    result = subprocess.run(
        ['git', 'status', '--short'],
        cwd=skill_dir,
        capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/git_ops.py (reported line 62)May include surrounding context.

python

# 添加变更
    if auto_add:
        console.print("\n[bold]添加所有变更...[/bold]")
        subprocess.run(['git', 'add', '-A'], cwd=skill_dir, check=True)
    
    # 提交
    console.print(f"\n[bold]提交：{message}[/bold]")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/git_ops.py (reported line 66)May include surrounding context.

python

# 提交
    console.print(f"\n[bold]提交：{message}[/bold]")
    result = subprocess.run(
        ['git', 'commit', '-m', message],
        cwd=skill_dir,
        capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/git_ops.py (reported line 75)May include surrounding context.

python

if result.returncode == 0:
        # 获取提交 hash
        result_hash = subprocess.run(
            ['git', 'rev-parse', '--short', 'HEAD'],
            cwd=skill_dir,
            capture_output=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file contains natural-language strings such as the module docstring, option help text, and console output exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/publish.py (reported line 55)May include surrounding context.

python

# 2. 检查 ClawHub 是否可用
    try:
        result = subprocess.run(
            ['clawhub', '--help'],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · commands/publish.py (reported line 114)May include surrounding context.

python

cmd.extend(['--changelog', changelog])
    
    try:
        result = subprocess.run(
            cmd,
            cwd=skill_dir,
            capture_output=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file uses natural-language strings exclusively in Chinese, starting with the module docstring at L002 and continuing throughout user-facing CLI messages. The file does not offer a language choice or explain that the tool is intentionally region-specific, which can violate the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file uses natural-language text exclusively in Chinese in the module docstring, and the same locale-specific wording continues throughout user-visible issue messages. For a general-purpose quality scanning skill, this imposes a language choice without any opt-in or documented regional justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.