ClawHub
Back to skill

Security audit

Phy Code Smell

Security checks for vulnerabilities and agentic risk

Overview

This is a local code-quality scanning skill with no evidence of network access, persistence, credential handling, or destructive behavior.

Installers should understand that the skill can read and analyze source files under the selected project root and print code-derived findings. Use an explicit --root for sensitive workspaces if you want to limit the scan scope.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
93% confidence
Finding
An overly broad trigger phrase can cause the skill to activate during ordinary developer conversation, leading to unintended execution over a repository. In an agent context, accidental invocation can consume resources, expose repository structure/content to the skill pipeline, and cause surprising side effects in automated workflows.

Vague Triggers

Medium
Confidence
88% confidence
Finding
This trigger example is broad enough to match routine planning or review requests, increasing the chance of unintended skill activation. In agent ecosystems, ambiguous auto-invocation can result in unnecessary scanning of local codebases and leakage of code-derived findings where the user did not clearly opt in.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The phrasing is indistinguishable from normal conversational requests about project quality, so an orchestrator may invoke the skill unintentionally. Because this skill recursively scans files, accidental activation is more dangerous than a no-op skill: it can process substantial code content and generate outputs the user did not explicitly request.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The manifest description at L0003 limits supported languages to Python, JavaScript/TypeScript, Java, Go, and Ruby. However, the actual extension map includes `.kt` under the `java` bucket, meaning Kotlin files are analyzed too.

Intent-Code Divergence

Low
Confidence
92% confidence
Finding
The implementation note explicitly states the tool should accept `--root` and optional `--min-severity`. The actual CLI parser defines additional behavior-changing flags, so the inline documentation understates what the command really accepts.

Static analysis

No suspicious patterns detected.