ClawHub
Back to skill

Security audit

CodeGraph

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local code-structure analyzer that writes a project cache and does not show hidden, network, credential, persistence, or destructive behavior.

Before installing, know that running the skill creates a local .code-graph.json cache containing structural information about the selected project, and it will also analyze Ruby files despite the main description only naming Python and JavaScript/TypeScript. Use --exclude or --output if you want tighter control over what is scanned or where the cache is stored.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The core behavior substantially matches the declared purpose: it builds structural summaries, call graphs, import graphs, caches them to JSON, and supports queries useful for codebase navigation. However, there is a material description-behavior mismatch because the declared language support says only Python and JavaScript/TypeScript, while the code also analyzes Ruby files and includes Ruby-specific extraction such as classes, methods, associations, scopes, and callbacks. That is an undeclared capability. Additionally, the code supports extra query modes like classes, stats, and search, though these are adjacent to the stated purpose and are less significant than the language-support mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file docstring explicitly states support for Ruby, and the implementation includes Ruby-specific extensions, regexes, and a full analyze_rb path in project scanning. This exceeds the manifest's declared language scope of Python and JavaScript/TypeScript.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring says --query calls <func_name> answers 'who calls func?' and --query callers <func_name> answers 'who does func call?'. In code, calls queries call_graph (what the function calls) and callers queries reverse_graph (who calls the function), so the documentation actively contradicts behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.