ClawHub
Back to skill

Security audit

代码质量审查

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only code review checklist skill; the flagged dangerous strings are examples of what to look for, not actions the skill performs.

Installers should expect this skill to influence code-review conversations and possibly be invoked broadly around implementation, refactoring, bug fixes, and proposal review. It does not appear to add executable code, persistence, network behavior, or privilege escalation, but users who want narrower activation may prefer to edit the trigger wording before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
|----------|---------|---------|
| 提示注入(5种) | 指令覆盖、隐藏指令、有害内容 | 检查 markdown 注释/隐藏 HTML/零宽字符 |
| 数据外泄(4种) | 发送 env vars/文件到外部服务器 | grep `fetch`/`http`/`curl` + 检查目标URL |
| 特权升级(3种) | sudo/root/cron 持久化 | grep `sudo`/`chmod 777`/`cron`/`systemctl` |
| 供应链(6种) | 未锁定依赖、`curl\|bash`、混淆代码 | 检查 unpinned deps / Base64 / `eval()` |
| 过度代理(4种) | 不受限工具访问、自主高影响决策 | 审查工具白名单是否有 `*` 通配符 |
| 系统提示泄漏(3种) | 直接/间接提取系统指令 | 检查输出是否可能包含内部 prompt |

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.

md
**Phase A: 静态扫描（原有）**
1. **危险函数扫描**：检查 scripts/ 目录是否有 `exec`/`eval`/`subprocess`/`__import__`
2. **网络行为**：grep 所有 `.js`/`.py`/`.sh` 中的外部URL，标记非已知域名
3. **依赖锁定**：检查是否有 unpinned deps（`*` 版本）或 `curl | bash`
4. **隐藏指令**：检查 markdown 中是否有 HTML 注释/零宽字符/Base64 编码块
5. **持久化检查**：grep `cron`/`systemctl`/`.bashrc`/`startup`/`schedule`

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger description lists broad situations such as 'after implementation', 'after refactoring', and 'before submitting a proposal' without defining explicit invocation phrases, scope boundaries, or exclusion conditions. In a markdown skill description, this can cause the skill to activate in many ordinary engineering conversations or routine workflow contexts unintentionally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The 'When to Use' section says to use the skill before merging any PR or change and after many common activities, but it does not distinguish mandatory review contexts from incidental mentions of those activities. This lacks trigger specificity and may lead to unintended invocation during normal developer assistance requests.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
|----------|---------|---------|
| 提示注入(5种) | 指令覆盖、隐藏指令、有害内容 | 检查 markdown 注释/隐藏 HTML/零宽字符 |
| 数据外泄(4种) | 发送 env vars/文件到外部服务器 | grep `fetch`/`http`/`curl` + 检查目标URL |
| 特权升级(3种) | sudo/root/cron 持久化 | grep `sudo`/`chmod 777`/`cron`/`systemctl` |
| 供应链(6种) | 未锁定依赖、`curl\|bash`、混淆代码 | 检查 unpinned deps / Base64 / `eval()` |
| 过度代理(4种) | 不受限工具访问、自主高影响决策 | 审查工具白名单是否有 `*` 通配符 |
| 系统提示泄漏(3种) | 直接/间接提取系统指令 | 检查输出是否可能包含内部 prompt |

Static analysis

No suspicious patterns detected.