ClawHub
Back to skill

Security audit

Argus Pro — Code Intelligence Scanner

Security checks for vulnerabilities and agentic risk

Overview

Argus Pro appears to be a purpose-aligned local code scanner, but its install instructions modify the system Python environment in an unsafe, under-disclosed way.

Review before installing. Use a virtual environment or pinned dependency file instead of the documented `--break-system-packages` command, and avoid scanning sensitive repositories unless you are comfortable with local report files containing paths and snippets.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:84
Finding

Unpinned Package Installation into the System Python Environment

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 84
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip3 install rich --break-system-packages --quiet

Technical Analysis

The installation command retrieves rich and its transitive dependencies from pip's configured package index without pinning versions or verifying cryptographic hashes. Consequently, the dependency content can change after the skill has been reviewed.

The --break-system-packages option also bypasses Python's externally managed environment protection. Rather than installing into an isolated virtual environment, the command may modify the host's system-level Python environment and alter packages shared by unrelated applications.

This is a supply-chain weakness rather than evidence that the currently named package is malicious. Exploitation would require compromise or manipulation of the configured package source, package release, dependency resolution process, or network trust boundary.

Attack Path

  1. An attacker compromises a package or transitive dependency release, controls a configured pip index, or otherwise influences package resolution.
  2. A user follows the skill's installation instruction.
  3. pip resolves and downloads mutable, unverified package artifacts.
  4. Package installation behavior executes with the permissions of the user running pip.
  5. Because --break-system-packages is enabled, affected packages may be installed into or replace components in the host Python environment.
  6. Malicious installation behavior could execute commands, access data available to that user, or modify Python components used by other local applications.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account running the installation. The accessible scope could include that user's files, credentials ...[truncated 337 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create and use a dedicated virtual environment instead of modifying the system Python installation.
  2. Remove the --break-system-packages option.
  3. Pin rich and every transitive dependency to audited versions in a lock file.
  4. Record and enforce cryptographic hashes, such as through:
    bash
    python3 -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.txt
  5. Use a trusted, explicitly configured package index over TLS and apply appropriate index allowlisting in controlled environments.
  6. Run dependency installation as an unprivileged user and periodically scan locked dependencies for known vulnerabilities.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installation step recommends pip3 install rich --break-system-packages --quiet without warning about the risks of overriding system package protections. This can damage the host Python environment, interfere with OS-managed packages, and create hard-to-recover system instability on user machines or CI runners.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill writes Markdown and JSON reports to local files by default, but the description does not clearly warn users about this side effect. In sensitive repositories, this can leave scan artifacts containing file paths, code snippets, and findings on disk unexpectedly, which may later be committed, shared, or consumed by other tooling.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
# Pro: Scan both languages if directory
SCAN_LANGS = ["python","javascript"] if src.is_dir() and LANGUAGE == "auto" else [lang]

# ── Extended rule sets ────────────────────────────────────────────────────────
PYTHON_RULES = [
    # Security
    ("PY001","critical","security", r"\beval\s*\(",                              "eval() executes arbitrary code.",                         "Use ast.literal_eval() for safe literal evaluation."),

Static analysis

No suspicious patterns detected.