ClawHub
Back to skill

Security audit

仓库协作分析(专业版)

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate repository reporting helper, but its safety claims conflict with examples that install packages, write and push reports, and notify Slack.

Review this skill carefully before installing. Use it only if you are comfortable with an agent generating repository reports, writing them to disk, and potentially publishing them through CI, git push, and Slack. Keep local-only analysis separate from CI publication, use least-privilege tokens and webhooks, avoid sudo/package-install steps where possible, and confirm report contents and access controls before pushing or notifying anyone.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The skill explicitly claims a safety contract of read-only Git usage, no network, and no writes, but the CI example performs package installation, generates artifacts, commits/pushes reports, and sends Slack notifications. This mismatch is dangerous because users or downstream agents may trust the stated constraints and execute workflows that exfiltrate analysis artifacts, modify repositories, or require sensitive credentials.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The documented scope is repository collaboration analysis, yet the examples include external notification, remote publication, and system package installation that go beyond local analysis. Scope expansion increases attack surface by introducing credential use, network egress, and persistence of generated artifacts in places users may not expect.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The file states no extra API key is needed for core functionality, but then requires Slack webhook and Git platform tokens for related features. This inconsistency can mislead users into enabling integrations without appreciating that secrets are required and may be used to publish internal analysis data externally.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The availability section claims the skill is 'no network, no write,' while the same file instructs writing reports, pushing commits, notifying Slack, and testing connectivity. Contradictory trust signals are especially risky in agent settings because policy engines or users may approve execution based on the safer claim while the actual workflow performs materially riskier actions.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The error handling advises running ping to test network connectivity despite earlier claims of no network usage. On its own this is low severity, but it reinforces misleading safety assertions and may normalize unnecessary network probing in supposedly local-only workflows.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill describes exporting, saving, committing, pushing, and notifying about generated reports without clearly foregrounding that these actions write files and publish artifacts to repositories or external systems. Because the reports may contain sensitive workflow metadata, inadequate disclosure can lead to unintentional internal data exposure.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# ...
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
      - name: 执行仓库分析
Confidence
88% confidence
Finding
The CI example invokes sudo for apt-get update, introducing elevated privilege execution into a skill that is presented as a repository analysis tool. Privileged package management increases supply-chain and host modification risk, especially if users assume the skill is read-only and local in scope.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
      - name: 执行仓库分析
        run: |
Confidence
88% confidence
Finding
Using sudo apt-get install expands the skill from passive analysis into privileged system modification. In an agent or CI context, this can unexpectedly alter the environment, pull unpinned packages from the network, and widen the consequences of compromise.

Chaining Abuse

High
Category
Tool Misuse
Content
fetch-depth: 0
# ...
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
Confidence
79% confidence
Finding
The multi-line CI run block chains privileged networked package-management commands, which creates a larger execution surface than the skill's stated purpose suggests. In practice, chaining installation and later workflow actions can enable abuse paths where an agent follows broad shell instructions that modify the environment and then publish artifacts externally.

Static analysis

No suspicious patterns detected.