ClawHub
Back to skill

Security audit

Phy Session Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a local session-security scanning skill with no evidence of hidden network access, persistence, destructive behavior, or credential handling.

Install only if you want a lightweight local source scanner for session and cookie issues. Run it on repositories you intend to audit, review findings for false positives, and use --ci only when you are comfortable with builds failing on reported critical or high findings.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The documentation claims `uuid.uuid4()` is only flagged when used as a session ID, but the implemented regex matches `uuid.uuid4().hex` broadly and only relies on a loose nearby-context heuristic. This creates misleading behavior and can generate false positives, reducing trust in the scanner and potentially causing users to ignore real findings.

Static analysis

No suspicious patterns detected.