ClawHub
Back to skill

Security audit

Actor Identifier

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Git reporting purpose is understandable, but its documentation understates actions that can write files, push reports, use credentials, send Slack notifications, and run privileged CI commands.

Review this skill carefully before installing. Use it only for repositories where automated report generation and possible sharing are acceptable, and do not enable the CI, git push, Slack, or token-based steps unless you explicitly want those outputs written or sent externally.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The skill claims it is local-only, read-only, and performs no writes or network access, but other sections instruct generating files, committing/pushing reports, and sending Slack notifications. This mismatch can mislead users and downstream agents into approving or running the skill under false assumptions, increasing the chance of unintended data exfiltration or repository modification.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The stated security contract says only read-only git subcommands are allowed and that no network operations occur, yet the CI examples use mutating git commands and external Slack integration. Contradictory security guarantees undermine trust boundaries and can cause agents or users to execute higher-risk actions they were told would never happen.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The FAQ says some functions require API keys, contradicting earlier statements that the skill is local-only and needs no extra API key for core operation. While less severe than direct command abuse, this inconsistency obscures what external integrations exist and may lead users to expose credentials unnecessarily.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The invocation description is broad enough to match generic analysis, reporting, and visualization requests beyond the narrow repo-analysis purpose. Overbroad routing increases the chance that an agent invokes this skill in contexts where exec-capable behavior, repository access, or report publication is unnecessary or unsafe.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The examples include publishing reports, committing artifacts, pushing to remotes, and sending Slack messages, but they do not prominently warn that repository-derived data may leave the local environment. Users may assume all outputs remain local because other sections repeatedly claim local-only behavior.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# ...
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
      - name: 执行仓库分析
Confidence
88% confidence
Finding
The CI example instructs running package management commands with sudo, elevating privileges during execution. In an exec-capable skill, normalizing privileged commands increases the blast radius of misuse and makes it easier for modified examples or chained instructions to alter the environment beyond the repository scope.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
      - name: 执行仓库分析
        run: |
Confidence
88% confidence
Finding
This line continues the privileged installation flow with sudo package installation. Even if common in CI, embedding privileged commands in a skill that is presented as safe/local-only weakens guardrails and can facilitate broader system modification if the workflow is adapted or abused.

Chaining Abuse

High
Category
Tool Misuse
Content
fetch-depth: 0
# ...
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y jq
# ...
Confidence
84% confidence
Finding
The skill combines exec-capable shell blocks, privileged package installation, repository operations, and later external publication/notification steps. This chaining pattern is dangerous because it creates an end-to-end path from local analysis to environment modification and outbound sharing, which is especially risky given the skill's contradictory claims that it is read-only and has no network access.

Static analysis

No suspicious patterns detected.