T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
src/tools/security-audit.js:66- Finding
Unrestricted Caller-Controlled Filesystem Reads
- Content
View full analysis
- Remediation
View remediation
Security audit
Astronclaw Code Review
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent code review assistant, but it can be asked to read local files outside a project and can generate unsafe HTML reports.
Review this skill before installing in sensitive environments. Use it only in a sandbox or workspace-scoped runtime, avoid letting untrusted prompts choose file paths, do not open generated HTML reports from untrusted code until escaping is fixed, and confirm any real AI-provider integration and data handling before enabling external analysis.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
src/tools/report-generator.js:330- Finding
Stored HTML Injection in Generated Review Reports
- Content
View full analysis
Code Review Report - ${results.summary?.filePath || 'Unnamed'} ``` ```javascriptFile: ${results.summary?.filePath || 'Not specified'}
``` Critical issue fields and analyzed source snippets are also embedded without escaping: ```javascript criticalIssues.forEach((issue, index) => { html += ``; }); ``` The generated HTML is then returned as report content: ```javascript return { content: html, format: 'html', fileName: results.summary?.filePath ? `${results.summary.filePath.replace(/\.[^/.]+$/, "")}-report.html` : 'code-review-report.html', size: html.length }; ``` ### Technical Analysis `GenerateReviewReport` accepts a caller-provided `reviewResults` object. Multiple properties from that object are treated as trusted HTML, including: - `results.summary.filePath` - `issue.message` - `issue.severity` - `issue.suggestion` - `issue.codeSnippet` No HTML escaping, context-sensitive encoding, or sanitization is applied before these values are inserted into the document. An attacker can therefore provide markup that terminates the intended element and injects a new HTML element or script. For example, a crafted source snippet containing a closi ...[truncated 2124 chars]${index + 1}. ${issue.message}
Location: Line ${issue.line}
Severity: ${issue.severity}
Suggestion: ${issue.suggestion || 'Refer to best practices'}
`; if (issue.codeSnippet) { html += ``; } html += `text ${issue.codeSnippet}- Remediation
View remediation
`, `"`, and `'` before inserting untrusted values into HTML. - Apply encoding appropriate to the destination context, including text nodes, attributes, and the document title. 2. **Treat analyzed source as plain text** - Never insert `codeSnippet` directly into a `pre` element. - HTML-escape the complete snippet before adding it to the report. 3. **Validate structured report input** - Define and enforce a schema for `reviewResults`. - Restrict severity and grade fields to fixed enumerations. - Validate numeric fields as finite numbers. - Limit lengths for filenames, messages, suggestions, and snippets. 4. **Use maintained rendering libraries** - Use a well-maintained templating engine with automatic escaping. - If Markdown is rendered into HTML, configure the renderer to reject raw HTML. - Sanitize the final HTML with a strict allowlist sanitizer as defense in depth. 5. **Apply a restrictive Content Security Policy** - Disallow inline scripts and remote script sources. - Avoid adding event-handler attributes or executable URLs. - Use a restrictive `default-src` policy appropriate to standalone reports. 6. **Separate output filename handling** - Derive output names with `path.basename`. - Remove path separators and control characters. - Do not reuse an untrusted source path as an output path or HTML value. 7. **Add regression tests** - Test payloads in filenames, issue messages, suggestions, severities, and snippets. - Verify that generated HTML displays each payload literally and creates no executable element. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (33)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node test/basic.test.js
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README states that AI features are integrated with the iFlytek Spark API, but it does not clearly warn users that reviewed source code may be sent to a third-party service when AI analysis is enabled. In a code-review skill, uploaded code can contain proprietary logic, secrets, credentials, or regulated data, so missing disclosure can lead to unintended data exposure and compliance violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises AI-driven review and notes that external network access is used for AI analysis, but it does not clearly warn users that submitted source code may be transmitted to a third-party AI provider. In a code-review context, this can expose proprietary code, credentials, secrets, or regulated data to an external service without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description is entirely in Chinese, while the skill is otherwise presented as a general-purpose code review assistant with no documented locale limitation or user language choice. This creates a natural-language policy concern because it implicitly constrains the skill to a specific language without opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code includes multiple user-facing console messages and descriptive text in Chinese, such as initialization and setup logs, while the skill does not provide any user opt-in or alternative locale handling. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s descriptive strings and user-facing messages are written in Chinese, and the implementation presents these messages directly without any indication that users can choose another language. This can violate language or locale policy when the skill imposes a single language by default without opt-in or documented regional justification.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The control flow in generateAIRecommendations says that if an AI API key and provider are supplied, it will use the real API. However, callIflytekSparkAPI is explicitly documented and implemented as a simulated implementation that returns mock data after a timeout. This is an active contradiction between the code comments/control-flow intent and the actual behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
When an API key and provider are configured, the function passes the full
codeand issue data tocallIflytekSparkAPI, which represents transmission to an external service. Although there is a console log about calling the API, there is no explicit user disclosure or confirmation that source code may be sent off-system, and this operation is not clearly justified as an expected deploy-like action in the file itself.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
getAIRecommendationDescription advertises provider-backed AI capabilities, including real-time AI analysis, batch processing, and API-key-enabled full functionality. In reality, the only provider-specific function is a mock that does not make network requests and instead synthesizes recommendations locally. This creates an intent-code divergence in the skill's own descriptive interface.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript file contains user-facing natural-language descriptions, messages, and console output exclusively in Chinese. The policy only permits a fixed language when the skill offers a language choice or clearly documents a justified locale constraint, neither of which appears here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains natural-language comments and user-visible console output in Chinese, such as the analyzer description and status messages. Under the policy rule for language/locale, forcing a specific language without user opt-in or justification is a policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The status log
📊 分析代码质量...is a user-visible string in Chinese, and similar messages later in the file also assume Chinese as the only language. This violates the language/locale policy unless the skill offers a language choice or is clearly documented as region-specific.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The completion and error messages are emitted only in Chinese, including success, warning, and failure text. Because the file provides no mechanism for locale selection and no documented regional constraint, this is a natural-language policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This JavaScript file contains natural-language descriptions and user-facing console messages in Chinese, such as the file header and analyzer output text. Because the skill does not offer language selection or justify a Chinese-only locale, it conflicts with the policy against forcing a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The analyzer prints status, warning, and error messages in Chinese, including progress and failure output. These are natural-language strings that impose a specific language on users or operators without any visible mechanism to choose another locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s user-facing natural-language strings and documentation are entirely in Chinese, including the tool description and execution messages. This creates a locale/language constraint without any indication that the user can choose another language or opt in, which matches the language-policy violation category.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code's descriptive comments and runtime console messages are entirely in Chinese, including user-visible status and error text. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JavaScript file contains all user-facing text in Chinese, including the tool description and execution-status messages, with no indication that the skill is China-specific or that users can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated HTML sets
lang="zh-CN", and the file consistently emits Chinese-only report titles, labels, and messages. This forces a specific language/locale on users without any opt-in, fallback, or documented region-specific justification, which matches the language/locale policy violation criteria.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JavaScript file contains natural-language strings and comments such as '安全审计工具' and '执行安全审计...', with no indication that users can choose another language. Per the policy, forcing a specific language/locale without opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This .js file contains natural-language strings and comments in Chinese, including user-facing console output throughout the test flow. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation, and this file provides no mechanism to select another language or justification that it is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Natural-language content throughout the README is presented only in Chinese, which can impose a language constraint on users without opt-in. The policy allows locale constraints when they are explicitly justified or when users are offered a choice, neither of which appears here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content throughout the skill documentation is presented in Chinese, including usage guidance and operational instructions. The file does not indicate that users can choose another language or that the Chinese-only presentation is a documented, justified locale constraint.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code standards section says '使用 TypeScript 开发' at L360, but the documented project structure lists
src/index.jsand JavaScript-based examples throughout the file (for example L187-L226 and L324-L335). This is an active documentation-to-implementation contradiction rather than a mere omission.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest-style metadata uses Chinese-only descriptions in fields intended to describe the skill, but provides no indication that the skill is China-specific or that users can choose another language. This can violate language/locale policy expectations when a skill implicitly forces a language without user opt-in.
- Content
Static analysis
Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- src/tools/analyzers/security-analyzer.js:110
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- test/basic.test.js:34
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:196
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test/basic.test.js:12