ClawHub
Back to skill

Security audit

代码安全审计员(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a coherent code-security checklist, but it asks for command execution and includes dependency update commands that can change a project without clear safeguards.

Review before installing if you expect a read-only checklist. Only run its exec-based dependency commands in a clean branch or isolated environment, pin any `npx` tools, inspect generated diffs, and test before accepting dependency changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:369
Finding

Unpinned Package Execution and Automatic Dependency Modification

Content
View full analysis
Remediation
View remediation
-u ``` 2. Prefer installing the reviewed tool as a development dependency and invoking the lockfile-resolved binary: ```bash npm install --save-dev --save-exact npm-check-updates@ npm exec npm-check-updates -- -u ``` 3. Use a trusted registry and enforce registry configuration to reduce dependency-confusion and source-substitution risks. 4. Commit and validate a lockfile. Review package provenance, integrity metadata, maintainership, and dependency changes before installation. 5. Run `npm audit` in reporting mode first. Avoid applying `npm audit fix` automatically in sensitive projects; inspect the proposed dependency diff and apply tested upgrades deliberately. 6. Review all manifest and lockfile changes generated by dependency tools. Run automated tests and security scans before merging or deploying them. 7. Where practical, disable package lifecycle scripts during initial inspection: ```bash npm install --ignore-scripts ``` Enable required scripts only after reviewing the affected packages. 8. Execute dependency-maintenance commands in an isolated, least-privileged environment without production credentials or unrelated filesystem access. ]]>

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

typescript
// ❌ BAD: 直接渲染用户输入
<div dangerouslySetInnerHTML={{ __html: userComment }} />
// ...
// ✅ GOOD: 消毒后渲染
import DOMPurify from 'isomorphic-dompurify'

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 349)May include surrounding context.

typescript
// ❌ BAD: 直接渲染用户输入
<div dangerouslySetInnerHTML={{ __html: userComment }} />
// ...
// ✅ GOOD: 消毒后渲染
import DOMPurify from 'isomorphic-dompurify'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description lists '中文解释与注释' as a differentiating characteristic, indicating a language constraint in the skill's behavior. There is no accompanying opt-in or alternative language option, so this can violate language/locale policy expectations for user choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The feature matrix explicitly states '自动扫描: 不支持' for the free version, indicating no automatic scanning capability. However, later in the document the '安全审计检查流程' provides a CodeSecurityAuditor implementation with an audit_file method that programmatically scans files for regex-defined OWASP patterns, which contradicts that claim.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation text says to use the skill whenever security detection, compliance audit, vulnerability scanning, or encryption protection is needed, which is a very wide range of ordinary developer requests. It does not define specific trigger phrases, scope boundaries, or concrete exclusion examples beyond a generic statement that out-of-scope needs are not suitable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document presents npm audit fix and npx npm-check-updates -u as routine remediation steps without warning that they can modify dependency manifests, lockfiles, and installed packages. In an agent-assisted environment, users may run them blindly, causing unreviewed code changes or introducing unstable or malicious updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill recommends running npx npm-check-updates -u without pinning a version. That causes execution of whatever package version is current at runtime, reducing reproducibility and creating a supply-chain risk if the package is compromised or behavior changes unexpectedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The FAQ states '免费版提供手动检查清单。专业版提供AST静态分析自动扫描', which tells users the free edition is limited to manual review. That conflicts with the earlier embedded Python auditor implementation that reads files and automatically detects vulnerability patterns, creating a direct intent-code divergence within the skill documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises exec-based command usage and troubleshooting commands without warning users about potential system or project-side effects. In an agent context, this can normalize command execution and lead to unintended modifications, especially when combined with dependency-management instructions elsewhere in the document.

Content

No source excerpt is available for this finding.