ClawHub
Back to skill

Security audit

claude-review

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent review purpose, but it runs an external Claude CLI with weakened permission checks and automatically stores review failures for future use.

Review the exact files or folders before invoking this skill, avoid using it on directories that may contain secrets, and consider disabling or redirecting LESSONS_FILE if you do not want review details retained. Install the Claude CLI only from a trusted source and be aware that reviewed content may be sent to the Claude service.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
review-work.sh:117
Finding

Unrestricted model-assisted file access can expose data outside the review scope

Content
View full analysis
"$STDERR_LOG") ``` ### Technical Analysis The script grants the Claude CLI local `Read`, `Glob`, and `Grep` tools while explicitly disabling permission enforcement through `--dangerously-skip-permissions`. The requested context path is communicated only through natural-language prompt content; it is not an operating-system-level or tool-level access boundary. Files under the context path, the optional skill path, the task summary, and the persistent lessons file must therefore be treated as untrusted prompt content. A malicious reviewed file can contain instructions asking the model to ignore the intended review scope and read sensitive files elsewhere on the filesys ...[truncated 1926 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
review-work.sh:142
Finding

Untrusted review output is persisted and reused as long-term agent context

Content
View full analysis
> "$LESSONS_FILE" fi ``` ### Technical Analysis The review output is influenced by several untrusted sources: - The user-provided task summary - Files under the context path - The optional skill definition - Existing lessons content If the output contains `VERDICT: FAIL`, lines containing the words `critical` or `major` are copied into `LESSONS.md`. This filtering does not validate semantics or distinguish genuine findings from attacker-authored directives. An attacker can induce the model to emit arbitrary imperative text containing one of those keywords. The res ...[truncated 2169 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Documentation recommends globally installing an unpinned executable dependency

Content
View full analysis
Remediation
View remediation
`. 2. Document the expected official registry and verify that npm is not configured to use an untrusted mirror. 3. Prefer a project-local dependency managed by a lockfile instead of a global installation. 4. Use reproducible installation methods such as `npm ci` with a committed lockfile. 5. Verify package provenance and integrity through registry signatures, checksums, or an internally approved artifact repository. 6. Audit the pinned package and its transitive dependencies before upgrading. 7. Disable lifecycle scripts during installation where operationally possible, then explicitly enable only required setup steps. 8. Do not install with administrative privileges; document that users must not use `sudo` for the package installation. 9. Validate the resolved executable path and expected version before invoking `claude`. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list includes broad everyday phrases such as "check your output," "self-review," and "quality check," which can cause the skill to activate in situations the user did not clearly intend. Because activation leads to running an external CLI and potentially reading/writing local files, accidental invocation expands the chance of unintended command execution and data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that failed reviews are automatically logged to LESSONS.md and auto-included in future reviews, but it does not clearly warn the user that task content, mistakes, or possibly sensitive material may be written to disk and persisted across sessions. This creates a privacy and data-governance risk, especially if reviewed artifacts contain secrets, proprietary code, or personal information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

Review a single file:

bash
review-work "Write a Python email validator" --context /tmp/email.py

Review with skill context (reviewer verifies against skill requirements):

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The instruction "Do NOT ask the user for arguments — you already know what you created" encourages the agent to make autonomous decisions about task summary, context paths, and optional skill paths without explicit user confirmation. In this skill, that autonomy matters because it can cause the agent to select broader-than-necessary files or folders for review and pass them to an external CLI, increasing the risk of unintended data exposure or command side effects.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
## What NOT to Do

- Do NOT ask the user for arguments — you already know what you created and which skill you used
- Do NOT say "review passed" without actually running the command
- Do NOT fabricate review results — the command produces real output
- Do NOT forget `--skill` when a skill was involved in the task

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · review-work.sh (reported line 40)May include surrounding context.

sh
echo "  --skill <path>        SKILL.md or skill folder used for the task (optional)"
      echo ""
      echo "Examples:"
      echo "  review-work \"Write a Python email validator\" --context /tmp/email.py"
      echo "  review-work \"Write an SEO blog\" --context /tmp/blog.md --skill ~/skills/seo-content-writer/SKILL.md"
      echo "  review-work \"Build a todo app\" --context /tmp/my-app/ --skill ~/skills/fullstack/SKILL.md"
      echo ""

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
echo ""
      echo "Examples:"
      echo "  review-work \"Write a Python email validator\" --context /tmp/email.py"
      echo "  review-work \"Write an SEO blog\" --context /tmp/blog.md --skill ~/skills/seo-content-writer/SKILL.md"
      echo "  review-work \"Build a todo app\" --context /tmp/my-app/ --skill ~/skills/fullstack/SKILL.md"
      echo ""
      echo "Environment:"

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · review-work.sh (reported line 41)May include surrounding context.

sh
echo ""
      echo "Examples:"
      echo "  review-work \"Write a Python email validator\" --context /tmp/email.py"
      echo "  review-work \"Write an SEO blog\" --context /tmp/blog.md --skill ~/skills/seo-content-writer/SKILL.md"
      echo "  review-work \"Build a todo app\" --context /tmp/my-app/ --skill ~/skills/fullstack/SKILL.md"
      echo ""
      echo "Environment:"

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
echo "Examples:"
      echo "  review-work \"Write a Python email validator\" --context /tmp/email.py"
      echo "  review-work \"Write an SEO blog\" --context /tmp/blog.md --skill ~/skills/seo-content-writer/SKILL.md"
      echo "  review-work \"Build a todo app\" --context /tmp/my-app/ --skill ~/skills/fullstack/SKILL.md"
      echo ""
      echo "Environment:"
      echo "  LESSONS_FILE    Path to lessons file (default: ~/.openclaw/workspace/LESSONS.md)"

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · review-work.sh (reported line 42)May include surrounding context.

sh
echo "Examples:"
      echo "  review-work \"Write a Python email validator\" --context /tmp/email.py"
      echo "  review-work \"Write an SEO blog\" --context /tmp/blog.md --skill ~/skills/seo-content-writer/SKILL.md"
      echo "  review-work \"Build a todo app\" --context /tmp/my-app/ --skill ~/skills/fullstack/SKILL.md"
      echo ""
      echo "Environment:"
      echo "  LESSONS_FILE    Path to lessons file (default: ~/.openclaw/workspace/LESSONS.md)"

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code comments describe the review as using read-only tools, but the claude invocation includes --dangerously-skip-permissions, which weakens safety controls and can permit broader tool behavior if CLI behavior changes or safeguards are bypassed. In a security-sensitive review utility, disabling permission checks contradicts the claimed trust model and increases blast radius.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script performs an undocumented state-changing action by appending review results to LESSONS.md, even though the skill is presented primarily as a review gate. This can leak task summaries, file names, paths, and review content into persistent storage without explicit user consent, which is risky in sensitive workspaces.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script automatically persists failure results to a lessons file with no explicit runtime notice or consent beyond comments in the source. This creates a quiet data-retention channel that may store sensitive task descriptions and review findings long after the review completes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.