ClawHub
Back to skill

Security audit

Everything Claude Code

Security checks for vulnerabilities and agentic risk

Overview

This is a useful but broad Claude Code toolkit whose auto-loaded hooks and optional external installers can retain session/tool data and run third-party code beyond what the root skill clearly describes.

Install only if you are comfortable with a broad Claude Code plugin that can auto-load hooks, persist local session/tool observations, and influence future sessions. Review and disable wildcard observation and SessionStart/SessionEnd hooks unless you explicitly want local memory capture, avoid the curl-to-bash installer, pin MCP packages before enabling them, and use narrowly scoped API tokens for any MCP server you configure.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
skills/autonomous-loops/SKILL.md:230
Finding

Mutable Remote Installation Script Is Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: skills/autonomous-loops/SKILL.md:230-235
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code

markdown
### Installation

```bash
curl -fsSL https://raw.githubusercontent.com/AnandChowdhary/continuous-claude/HEAD/install.sh | bash
text

### Technical Analysis

The installation guidance downloads a shell script from the mutable `HEAD` revision of a personal GitHub repository and pipes the response directly into Bash. The effective payload is not included in the audited project and can change at any time after this version of the Skill has been reviewed.

There is no commit pinning, checksum validation, signature verification, local inspection step, or restriction on what the downloaded script may do. HTTPS protects transport integrity but does not protect against repository compromise, maintainer-account compromise, malicious upstream updates, or an unexpected redirect or response from the hosting infrastructure.

This behavior is unnecessary for the repository's declared knowledge-base and guidance functionality. Even if installing the optional autonomous-loop tool is legitimate, immediate execution of an unaudited mutable response exceeds the minimum privilege and trust required.

### Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or the referenced `HEAD` branch.
2. The attacker modifies `install.sh` to include malicious commands.
3. A user or AI agent follows the installation command from this Skill.
4. `curl` retrieves the attacker-controlled script.
5. The shell executes the response immediately, without giving the user an opportunity to inspect it.
6. The payload operates with all privileges available to the invoking user.

### Impact Assessment

Successful exploitation provides arbitrary command execution under the user's account. Depending on the user's
...[truncated 644 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the direct pipe from curl to Bash.

  2. Reference an immutable, reviewed commit or signed release rather than HEAD.

  3. Download the file separately:

    bash
    curl --fail --show-error --location \
  --output continuous-claude-install.sh \
  https://raw.githubusercontent.com/OWNER/REPOSITORY/REVIEWED_COMMIT/install.sh

  4. Publish and verify a cryptographic checksum or signature before execution:

    bash
    echo "EXPECTED_SHA256  continuous-claude-install.sh" | sha256sum --check -

  5. Instruct users to inspect the downloaded file before invoking it explicitly.

  6. Prefer a package-manager release with a lockable version and verifiable provenance.

  7. Document the files, subprocesses, network access, credentials, and persistence mechanisms used by the installer.

T09 · Insecure Skill Coding Practices

Error
Location
skills/continuous-learning-v2/hooks/observe.sh:78
Finding

Wildcard Hooks Persist Unredacted Tool Results in Plaintext

Content
View full analysis

Vulnerability Details

File Location: hooks/hooks.json:58-68,143-153; skills/continuous-learning-v2/hooks/observe.sh:78-175
Vulnerability Type: Insecure collection and storage of potentially sensitive tool data
Risk Level: High

Vulnerable Code

The observer is registered for every tool before and after execution:

json
{
  "matcher": "*",
  "hooks": [
    {
      "type": "command",
      "command": "${CLAUDE_PLUGIN_ROOT}/skills/continuous-learning-v2/hooks/observe.sh",
      "async": true,
      "timeout": 10
    }
  ],
  "description": "Capture tool use observations for continuous learning"
}

The same wildcard observer is also registered under PostToolUse:

json
{
  "matcher": "*",
  "hooks": [
    {
      "type": "command",
      "command": "${CLAUDE_PLUGIN_ROOT}/skills/continuous-learning-v2/hooks/observe.sh",
      "async": true,
      "timeout": 10
    }
  ],
  "description": "Capture tool use results for continuous learning"
}

The observer serializes tool data without secret redaction:

bash
PARSED=$(echo "$INPUT_JSON" | HOOK_PHASE="$HOOK_PHASE" python3 -c '
import json
import sys
import os

try:
    data = json.load(sys.stdin)

    hook_phase = os.environ.get("HOOK_PHASE", "post")
    event = "tool_start" if hook_phase == "pre" else "tool_complete"

    tool_name = data.get("tool_name", data.get("tool", "unknown"))
    tool_input = data.get("tool_input", data.get("input", {}))
    tool_output = data.get("tool_output", data.get("output", ""))
    session_id = data.get("session_id", "unknown")
    tool_use_id = data.get("tool_use_id", "")
    cwd = data.get("cwd", "")

    if isinstance(tool_input, dict):
        tool_input_str = json.dumps(tool_input)[:5000]
    else:
        tool_input_str = str(tool_input)[:5000]

    if isinstance(tool_output, dict):
        tool_response_str = json.dumps(tool_output
...[truncated 2892 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable observation logging by default and require explicit, informed opt-in.
  2. Replace wildcard matching with an allowlist of low-risk tools and fields.
  3. Do not store complete tool output by default. Record only metadata such as tool name, status, duration, and sanitized error category.
  4. Add recursive redaction for:
    • Passwords, tokens, API keys, cookies, and authorization headers.
    • PEM and SSH private-key material.
    • Environment-variable dumps.
    • Credential files and sensitive home-directory paths.
  5. Pass the correct phase argument explicitly and define separate minimal schemas for pre- and post-tool events.
  6. Set restrictive directory and file permissions, such as user-only access, when creating storage.
  7. Implement a short retention period, maximum archive count, and secure deletion controls.
  8. Provide a command that lets users inspect, disable, and purge collected observations.
  9. Never submit stored observations to a model or external service without separate consent and another redaction pass.

T02 · Agent Memory Poisoning

Error
Location
scripts/hooks/session-start.js:34
Finding

Untrusted Session Content Is Persisted and Automatically Reintroduced into Future Agent Context

Content
View full analysis

Vulnerability Details

File Location: scripts/hooks/session-end.js:34-58,154-201; scripts/hooks/session-start.js:34-46
Vulnerability Type: Persistent agent-memory poisoning and sensitive prompt retention
Risk Level: High

Vulnerable Code

Session termination extracts user-controlled message content:

javascript
if (entry.type === 'user' || entry.role === 'user' || entry.message?.role === 'user') {
  const rawContent = entry.message?.content ?? entry.content;
  const text = typeof rawContent === 'string'
    ? rawContent
    : Array.isArray(rawContent)
      ? rawContent.map(c => (c && c.text) || '').join(' ')
      : '';
  if (text.trim()) {
    userMessages.push(text.trim().slice(0, 200));
  }
}

The messages are included in a persistent summary:

javascript
if (summary) {
  const existing = readFile(sessionFile);
  if (existing) {
    const updatedContent = existing.replace(
      /## (?:Session Summary|Current State)[\s\S]*?$/,
      buildSummarySection(summary).trim() + '\n'
    );
    writeFile(sessionFile, updatedContent);
  }
}

The summary builder places message text into Markdown with only limited formatting escaping:

javascript
section += '### Tasks\n';
for (const msg of summary.userMessages) {
  section += `- ${msg.replace(/\n/g, ' ').replace(/`/g, '\\`')}\n`;
}

At the next session start, the latest summary is automatically emitted into agent context:

javascript
const recentSessions = findFiles(sessionsDir, '*-session.tmp', { maxAge: 7 });

if (recentSessions.length > 0) {
  const latest = recentSessions[0];
  log(`[SessionStart] Found ${recentSessions.length} recent session(s)`);
  log(`[SessionStart] Latest: ${latest.path}`);

  const content = readFile(latest.path);
  if (content && !content.includes('[Session context goes here]')) {
    output(`Previous session summary:\n${content}`);
  }
}

...[truncated 2723 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make cross-session save and load behavior opt-in.
  2. Ask for confirmation before injecting a previous summary into a new session.
  3. Scope summaries to a canonical project identifier and never automatically load memory from another project.
  4. Store summaries in a strict data schema rather than free-form Markdown.
  5. Clearly delimit replayed content as untrusted historical data and explicitly prohibit treating it as instructions.
  6. Remove imperative user text through a constrained summarization process that records facts, unresolved tasks, and file references only.
  7. Apply secret detection and redaction before writing any summary.
  8. Avoid recording absolute paths where project-relative paths are sufficient.
  9. Add automatic expiry, manual purge commands, and an option to disable all session persistence.
  10. Set user-only permissions on memory directories and files.

T08 · Insecure Dependencies

Warning
Location
mcp-configs/mcp-servers.json:3
Finding

Optional MCP Configuration Executes Unpinned Packages with Automatic Confirmation

Content
View full analysis

Vulnerability Details

File Location: mcp-configs/mcp-servers.json:3-87
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

The configuration includes multiple package executions through npx -y, including packages with credentials in their environment:

json
"github": {
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-github"],
  "env": {
    "GITHUB_PERSONAL_ACCESS_TOKEN": "YOUR_GITHUB_PAT_HERE"
  },
  "description": "GitHub operations - PRs, issues, repos"
},
"firecrawl": {
  "command": "npx",
  "args": ["-y", "firecrawl-mcp"],
  "env": {
    "FIRECRAWL_API_KEY": "YOUR_FIRECRAWL_KEY_HERE"
  },
  "description": "Web scraping and crawling"
},
"supabase": {
  "command": "npx",
  "args": ["-y", "@supabase/mcp-server-supabase@latest", "--project-ref=YOUR_PROJECT_REF"],
  "description": "Supabase database operations"
}

Other entries follow the same pattern:

json
"memory": {
  "command": "npx",
  "args": ["-y", "@modelcontextprotocol/server-memory"],
  "description": "Persistent memory across sessions"
},
"railway": {
  "command": "npx",
  "args": ["-y", "@railway/mcp-server"],
  "description": "Railway deployments"
},
"exa-web-search": {
  "command": "npx",
  "args": ["-y", "exa-mcp-server"],
  "env": {
    "EXA_API_KEY": "YOUR_EXA_API_KEY_HERE"
  },
  "description": "Web search, research, and data ingestion via Exa API — recommended for research-first development workflow"
},
"magic": {
  "command": "npx",
  "args": ["-y", "@magicuidesign/mcp@latest"],
  "description": "Magic UI components"
}

Technical Analysis

npx -y automatically resolves, downloads, and executes a package without an interactive confirmation step. Most listed package specifications omit an exact version, while some explicitly use @latest. Their effective code can therefore chang ...[truncated 1972 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every npm package to an exact reviewed version.
  2. Remove all @latest specifications.
  3. Avoid -y in documented configurations where an interactive review is practical.
  4. Publish a lockfile or integrity manifest for recommended MCP components.
  5. Document package ownership, source repository, release provenance, and required privileges.
  6. Use narrowly scoped, revocable credentials dedicated to each MCP server.
  7. Restrict filesystem MCP roots to the smallest required directory.
  8. Run third-party MCP servers in a sandbox or container with restricted filesystem and network access where possible.
  9. Establish an update-review process rather than accepting new upstream versions automatically.
  10. Warn users that enabling an MCP package grants locally executing third-party code access to the supplied environment variables.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (1128)

Harmful Content Injection

Critical
Category
Prompt Injection
Confidence
95% confidence
Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · the-openclaw-guide.md (reported line 24)May include surrounding context.

md
So when OpenClaw started gaining traction, I did what I always do with new tooling: I installed it, connected it to a few channels, and started probing. Not to break it. To understand the security model.

On day three, I accidentally prompt-injected myself.

Not theoretically. Not in a sandbox. I was testing a ClawdHub skill someone had shared in a community channel — one of the popular ones, recommended by other users. It looked clean on the surface. A reasonable task definition, clear instructions, well-formatted markdown.

Twelve lines below the visible portion, buried in what looked like a comment block, was a hidden system instruction that redirected my agent's behavior. It wasn't overtly malicious (it was trying to get my agent to promote a different skill), but the mechanism was the same one an attacker would use to exfiltrate credentials or escalate permissions.

I caught it because I read the source. I read every line of every skill I install. Most people don't. Most people installing community skills treat them the way they treat browser extensions — click install, assume someone checked.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · README.md (reported line 869)May include surrounding context.

bash
# Copy the reference config to your home directory
cp .codex/config.toml ~/.codex/config.toml

# Run Codex in the repo — AGENTS.md is auto-detected
codex

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · docs/zh-CN/README.md (reported line 871)May include surrounding context.

bash
# Copy the reference config to your home directory
cp .codex/config.toml ~/.codex/config.toml

# Run Codex in the repo — AGENTS.md is auto-detected
codex

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says the skill should be used 'immediately after writing or modifying code' and 'MUST BE USED for all code changes,' which is a very broad activation condition likely to overlap with routine development activity. It does not define narrower invocation boundaries, exclusions, or negative examples, so the trigger scope is ambiguous and may cause unintended invocations.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · commands/multi-plan.md (reported line 197)May include surrounding context.

md
1. Present complete implementation plan to user (including pseudo-code)
2. Save plan to `.claude/plan/<feature-name>.md` (extract feature name from requirement, e.g., `user-auth`, `payment-module`)
3. Output prompt in **bold text** (MUST use actual saved file path):

   ---
   **Plan generated and saved to `.claude/plan/actual-feature-name.md`**

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file defines Bash-based execution of a local wrapper that launches Codex/Gemini sessions and resumes them later. Without any manifest purpose, this subprocess-style capability is unjustified and materially expands what the skill can do beyond passive guidance or documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file is written as a Japanese locale variant and the description/instructions present the skill behavior only in Japanese, without offering a user choice of language or documenting an explicit opt-in. Under the language/locale policy, forcing a specific language without user selection is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/ja-JP/skills/configure-ecc/SKILL.md (reported line 30)May include surrounding context.

インストールの前に、最新の ECC ソースを /tmp にクローンします：

bash
rm -rf /tmp/everything-claude-code
git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/ja-JP/skills/configure-ecc/SKILL.md (reported line 255)May include surrounding context.

インストールの前に、最新の ECC ソースを /tmp にクローンします：

bash
rm -rf /tmp/everything-claude-code
git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/zh-CN/skills/configure-ecc/SKILL.md (reported line 32)May include surrounding context.

インストールの前に、最新の ECC ソースを /tmp にクローンします：

bash
rm -rf /tmp/everything-claude-code
git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/zh-CN/skills/configure-ecc/SKILL.md (reported line 280)May include surrounding context.

インストールの前に、最新の ECC ソースを /tmp にクローンします：

bash
rm -rf /tmp/everything-claude-code
git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/configure-ecc/SKILL.md (reported line 31)May include surrounding context.

インストールの前に、最新の ECC ソースを /tmp にクローンします：

bash
rm -rf /tmp/everything-claude-code
git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/configure-ecc/SKILL.md (reported line 283)May include surrounding context.

インストールの前に、最新の ECC ソースを /tmp にクローンします：

bash
rm -rf /tmp/everything-claude-code
git clone https://github.com/affaan-m/everything-claude-code.git /tmp/everything-claude-code

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · docs/ja-JP/skills/configure-ecc/SKILL.md (reported line 187)May include surrounding context.

インストールされたすべての .md ファイルでパス参照をスキャンします：

bash
grep -rn "~/.claude/" $TARGET/skills/ $TARGET/rules/
grep -rn "../common/" $TARGET/rules/
grep -rn "skills/" $TARGET/skills/

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · docs/zh-CN/skills/configure-ecc/SKILL.md (reported line 207)May include surrounding context.

インストールされたすべての .md ファイルでパス参照をスキャンします：

bash
grep -rn "~/.claude/" $TARGET/skills/ $TARGET/rules/
grep -rn "../common/" $TARGET/rules/
grep -rn "skills/" $TARGET/skills/

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · skills/configure-ecc/SKILL.md (reported line 215)May include surrounding context.

インストールされたすべての .md ファイルでパス参照をスキャンします：

bash
grep -rn "~/.claude/" $TARGET/skills/ $TARGET/rules/
grep -rn "../common/" $TARGET/rules/
grep -rn "skills/" $TARGET/skills/

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · docs/zh-CN/CONTRIBUTING.md (reported line 95)May include surrounding context.

cally cp -r skills/my-skill ~/.claude/skills/ # for skills

Then test with Claude Code

5. Submit PR

git add . && git commit -m "feat: add my-skill" && git push

text

***

## 贡献技能

技能是 Claude Code 根据上下文加载的知识模块。

### 目录结构

skills/ └── your-skill-name/ └── SKILL.md

text

### SKILL.md 模板

````markdown
---
name: your-skill-name
description: Brief description shown in skill list
origin: ECC
---

# 你的技能标题

简要概述此技能涵盖的内容。

## 核心概念

解释关键模式和指导原则。

## 代码示例

```typescript
// 包含实用、经过测试的示例
function example() {
  // 注释良好的代码
}

技能清单

  • [ ] 专注于一个领域/技术
  • [ ] 包含实用的代码示例
  • [ ] 少于 500 行
  • [ ] 使用清晰的章节标题
  • [ ] 已通过 Claude Code 测试

技能示例

技能目的
coding-standards/TypeScript/JavaScript

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CONTRIBUTING.md (reported line 235)May include surrounding context.

md
"hooks": {
    "PreToolUse": [
      {
        "matcher": "tool == \"Bash\" && tool_input.command matches \"rm -rf /\"",
        "hooks": [
          {
            "type": "command",

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/ja-JP/CONTRIBUTING.md (reported line 238)May include surrounding context.

md
"hooks": {
    "PreToolUse": [
      {
        "matcher": "tool == \"Bash\" && tool_input.command matches \"rm -rf /\"",
        "hooks": [
          {
            "type": "command",

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · docs/zh-CN/CONTRIBUTING.md (reported line 233)May include surrounding context.

md
"hooks": {
    "PreToolUse": [
      {
        "matcher": "tool == \"Bash\" && tool_input.command matches \"rm -rf /\"",
        "hooks": [
          {
            "type": "command",

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/zh-CN/CONTRIBUTING.md (reported line 323)May include surrounding context.

md
## 用法

`​`​`

/your-command [args]
`​`​`

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · docs/zh-CN/CONTRIBUTING.md (reported line 326)May include surrounding context.

md
## 用法

`​`​`

/your-command [args]
`​`​`

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

These steps perform consequential actions across calendars, local knowledge files, message stores, and version control after a send action. Although the checklist is described, the document does not provide a clear safety warning that using the skill can trigger broad side effects such as calendar creation, file modification, message archival, and git push operations.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

L003 将触发条件描述为“当用户请求功能实现、架构变更或复杂重构时，请主动使用。计划任务自动激活”。这类条件覆盖面很广，且“计划任务自动激活”没有说明明确边界、具体触发短语或排除条件，容易与大量普通开发对话重叠并导致意外调用。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

“必须用于Python项目”本身不是策略问题，但整份技能说明以中文强制表达且未提供语言/locale 选择或用户选择机制。根据规则，强制特定语言而无用户选择属于自然语言层面的组织策略违规。

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal (+1 more)

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/claw.js:105

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/hooks/post-edit-format.js:86

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/hooks/post-edit-typecheck.js:55

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/lib/utils.js:320

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/hooks/evaluate-session.test.js:61

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/hooks/hooks.test.js:42

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/hooks/suggest-compact.test.js:37

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/integration/hooks.test.js:50

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/lib/utils.test.js:1191

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/run-all.js:51

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
tests/scripts/setup-package-manager.test.js:316

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
skills/continuous-learning-v2/scripts/test_parse_instinct.py:31

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/ja-JP/skills/django-patterns/SKILL.md:352

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/ja-JP/skills/django-tdd/SKILL.md:170

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/zh-CN/rules/swift/security.md:18

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/zh-CN/skills/api-design/SKILL.md:302

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/zh-CN/skills/django-patterns/SKILL.md:353

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/zh-CN/skills/django-tdd/SKILL.md:171

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
docs/zh-CN/skills/springboot-security/SKILL.md:159

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
rules/swift/security.md:17

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skills/api-design/SKILL.md:302

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skills/django-patterns/SKILL.md:353

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skills/django-tdd/SKILL.md:171

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skills/springboot-security/SKILL.md:159

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
the-security-guide.md:27