ClawHub
Back to skill

Security audit

Code Analysis Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a code-analysis/Git-history reporting helper, but it asks for shell execution and makes broader capability claims without clear boundaries.

Review before installing. Use it only on repositories where you are authorized to inspect Git history, and require the agent to ask before running shell commands or changing files. Treat the advertised vulnerability, CI/CD, and remediation capabilities as under-documented unless the publisher provides clearer scope and safeguards.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill declares the exec tool, which can enable shell command execution, but provides no meaningful warning, boundary, or safety guidance about what commands may run, what files may be touched, or how to avoid unsafe operations. In the context of a code-analysis skill, exec access materially increases risk because users may assume read-only reporting while the skill can potentially invoke commands against local repositories or the broader environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill manifest and core description say it produces a descriptive Git-history reflection report, but the documentation markets materially broader capabilities such as static analysis, dependency vulnerability detection, CI/CD integration, and refactoring guidance. This kind of scope mismatch is dangerous because users and agent platforms may grant permissions, trust, or make purchasing decisions based on incomplete or misleading declarations, increasing the chance of unintended code access or execution under false expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The natural-language description alternates between Chinese and English, but nowhere states whether output language follows user preference or allows opt-in selection. This can violate language/locale policy when a skill implicitly forces or defaults to a language without making that behavior configurable.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The description explicitly states '移除风险代码,增强安全性和稳定性' (remove risky code, enhance security and stability), which implies active code modification or at least a remediation capability. Elsewhere, the skill is described as producing descriptive Git-history reports and analysis outputs, with no documented implementation steps or outputs showing code removal or direct hardening actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.