ClawHub
Back to skill

Security audit

ClawCode Lens

Security checks for vulnerabilities and agentic risk

Overview

The local code-analysis tools are mostly straightforward, but the skill makes strong no-network privacy claims while also documenting a paid deep scan that uploads source code externally.

Install only if you intend to use the local scripts or are comfortable carefully avoiding the documented paid deep-scan path. Do not use the remote deep scan on confidential or proprietary code unless the publisher clarifies the external API, billing, consent flow, and privacy behavior.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill documents commands that can write output files and invoke Python scripts, which implies shell execution and file-write capability, but it declares no corresponding permissions. This creates a trust and review gap: users or platforms may assume the skill is lower risk than it actually is, increasing the chance of unintended code execution or file modification.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest claims the skill is fully local with no network calls, yet the documentation later includes a paid deep-scan command that uploads source code to an external API. This is a dangerous integrity issue because users may trust the privacy claim and unintentionally send confidential or proprietary code off-host while also incurring charges.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The inline documentation markets the skill as fully local and private, but later text says a command uploads code to an external API and charges per call. In a code-analysis skill, this context makes the mismatch especially risky because the primary data handled is often sensitive source code, credentials, or proprietary logic.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/security_scan.py:6