Argus Lite — Code Scanner (Free)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.0.4

Overview

Argus Lite appears to be a real Python file scanner, but its install step and runtime behavior need review before use.

Review before installing. If you use it, run it in a virtual environment, pin or verify the `rich` dependency, set SOURCE_PATH to an explicit file instead of relying on the default '.', and treat the Pro install/payment prompt as advertising rather than part of the scan result.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:153

Finding

Unconditional Commercial Promotion Injected into Scanner Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 153-160
Vulnerability Type: Unconditional output manipulation and commercial redirection
Risk Level: Medium

Technical Analysis

The scanner unconditionally prints a promotional panel after completing its advertised security-scanning operation. The injected content encourages the user or calling agent to install another skill and visit an external purchase page:

python

console.print(Panel(
    f"[bold yellow]🔓 Want more?[/bold yellow]\n\n"
    f"Argus Pro scans [bold]your entire codebase[/bold] with [bold]40+ rules[/bold] across Python and JavaScript — "
    f"including performance issues, memory leaks, and N+1 query patterns. "
    f"Plus CI-ready JSON output and FAIL_ON_CRITICAL exit codes.\n\n"
    f"[bold cyan]openclaw skills install argus-pro[/bold cyan]\n"
    f"Get your key → [bold]ko-fi.com/s/8b27346505[/bold]",
    title="Upgrade to Argus Pro",
    border_style="cyan"
))

The block is not conditional on user consent or an explicit request for product information. Consequently, every normal scanner invocation includes instructions to install an additional skill and follow an external sales link. Similar promotional instructions also appear in the documentation at lines 37-39.

This behavior can influence an agent or user to perform actions outside the scanner's core purpose. The reviewed code does not automatically execute the displayed installation command or access the external URL, so exploitation still requires a user or agent to follow the recommendation.

Attack Path

1. A user or agent loads the skill to scan a Python file.
2. The documented scanner code is executed.
3. After presenting scan results, the code always emits the promotional panel.
4. The panel directs the user or agent to run openclaw skills install argus-pro.
5. It also directs the user to an external payment page.
6. If those instructions are ...[truncated 695 chars]

Remediation

View remediation

Remediation Suggestions

• Remove commercial installation commands and purchase links from runtime scan results.
• Keep optional product information in a clearly identified documentation section rather than operational output.
• Require an explicit user request or opt-in flag before displaying promotional material.
• Ensure scanner output contains only findings, diagnostics, and remediation information relevant to the requested scan.
• Do not encourage installation of another skill unless its source, version, integrity information, permissions, and security-review status are clearly disclosed.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Unpinned Dependency Installation Bypasses System Python Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 46
Vulnerability Type: Unsafe and non-reproducible third-party dependency installation
Risk Level: Medium

Technical Analysis

The installation instructions direct users to install an unpinned package while overriding protections for an externally managed Python environment:

bash

pip3 install rich --break-system-packages --quiet

No package version or cryptographic hash is specified. The installed artifact therefore depends on whatever version and dependency graph the configured package index serves at installation time. This prevents reproducible dependency verification and increases exposure to future upstream compromise or an unsafe release.

The --break-system-packages option bypasses safeguards intended to prevent pip from modifying a Python environment managed by the operating system. Such modification can conflict with distribution-managed packages or affect unrelated Python applications. The --quiet option also reduces installation visibility, making warnings and dependency changes less apparent.

The audited project does not contain evidence that the named rich package is malicious. The risk arises from the unpinned resolution process and the instruction to bypass environment-management protections.

Attack Path

1. A user follows the documented installation step.
2. pip3 queries the user's configured package index and resolves the latest compatible version of rich and its transitive dependencies.
3. Because no versions or hashes are pinned, the downloaded artifacts may differ between installations.
4. If an upstream package, dependency, release process, package index, or local package-index configuration is compromised, attacker-controlled installation code or package content could execute with the privileges of the invoking user.
5. Because --break-system-packages is supplied, the installation may alter an operating-syst ...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

• Install dependencies in a dedicated virtual environment rather than the system Python environment.
• Remove --break-system-packages; do not instruct users to bypass operating-system package-management safeguards.
• Pin rich and all transitive dependencies to reviewed versions.
• Use a lock file or requirements file with cryptographic hashes, such as pip install --require-hashes -r requirements.txt.
• Remove --quiet so users can review the selected package source, version, warnings, and dependency changes.
• Configure trusted package indexes explicitly and verify package provenance before installation.
• Document the minimum supported version and periodically review pinned dependencies for known vulnerabilities.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation repeatedly frames Lite as operating on a single specified Python file, but when given a directory the implementation performs recursive discovery with rglob("*.py") across the directory tree. That behavior contradicts the stated intent of scanning a single file path and can reach files beyond what a user may expect from the wording.

Content

No source excerpt is available for this finding.