ClawHub
Back to skill

Security audit

argus

Security checks for vulnerabilities and agentic risk

Overview

Argus is a coherent testing helper, but it installs persistent Git automation and can rewrite commit history and install dependencies without strong user control.

Review this skill before installing it in an active repository. Use it only where you are comfortable with .argus state files, generated tests, a persistent Git post-commit hook, possible commit-message amendment, and automatic Python/Playwright dependency installation. Inspect .git/hooks/post-commit after init and avoid running it on shared or signed-commit workflows unless amendment and hook behavior are disabled or explicitly approved.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:151
Finding

Persistent Git Post-Commit Hook Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 151–171
Vulnerability Type: Persistent executable Git hook
Risk Level: High

Vulnerable Code

bash
Write `.argus/commit-hook.sh`:
#!/bin/bash
# Argus post-commit hook
# Enriches insufficient commit messages and runs incremental tests

COMMIT_MSG=$(git log -1 --format="%s%n%b")
CHANGED_FILES=$(git diff HEAD~1 HEAD --name-only 2>/dev/null || echo "")

# Pass to argus for analysis
echo "[Argus] Analyzing commit..."
# Claude will be invoked here via: claude -p "argus post-commit"
# For now, log for manual review
echo "[Argus] Changed files: $CHANGED_FILES" >> .argus/commit-log.txt
echo "[Argus] Message: $COMMIT_MSG" >> .argus/commit-log.txt

cp .argus/commit-hook.sh .git/hooks/post-commit
chmod +x .git/hooks/post-commit

Technical Analysis

The initialization procedure creates an executable script and installs it as .git/hooks/post-commit. Git automatically executes this hook after every subsequent commit in the repository, including after the original Argus operation has ended.

This establishes cross-session persistence. The installation also uses cp without checking whether a post-commit hook already exists, so it can overwrite legitimate repository automation. The installed hook records changed filenames and complete commit messages in .argus/commit-log.txt. Commit bodies can contain internal issue details, repository paths, or other sensitive development metadata.

Although the documented version of the hook only writes local logs, its persistent execution position is security-sensitive: later modification of .argus/commit-hook.sh does not update the copied hook, but any direct modification of .git/hooks/post-commit would execute on every commit under the developer's account.

Attack Path

  1. A user installs the Skill and runs /argus init.
  2. The Skill writes .argus/commit-hook.sh.
  3. It copies the scri ...[truncated 973 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not install a Git hook automatically during initialization.
  • Make hook installation a separate, explicit, opt-in operation with a clear description of its persistence and data collection.
  • Check whether .git/hooks/post-commit already exists. Never overwrite it without informed user confirmation.
  • Prefer a managed hook framework that can safely chain multiple hooks.
  • Back up any existing hook before installation and provide a documented uninstall command.
  • Minimize logged data. Avoid storing full commit bodies by default and provide configurable retention.
  • Apply restrictive permissions to generated log files and exclude them from version control.
  • Display the exact hook content before installation and verify its integrity before each update.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:454
Finding

Unpinned Runtime Installation of Python Packages and Browser Artifacts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 454–460
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
cd {project_root}

# Check if pytest-playwright is available
if ! python -c "import pytest_playwright" 2>/dev/null; then
    echo "[Argus] Installing browser testing dependencies..."
    pip install pytest-playwright playwright -q
    playwright install chromium 2>/dev/null || echo "[Argus] Chromium may need manual install: playwright install chromium"
fi

Technical Analysis

The Skill instructs the agent to install pytest-playwright, playwright, and Chromium artifacts automatically during frontend testing. No versions, hashes, lockfile, package index, or isolated environment are specified.

Consequently, the effective code installed can change after the Skill has been reviewed. Python package installation can execute package build and installation logic, while Playwright downloads and installs a substantial browser binary and associated artifacts. Using whichever pip, python, and playwright executables happen to resolve from the current environment also creates ambiguity about the affected interpreter and installation scope.

The import check only verifies pytest_playwright; it does not validate package versions, artifact integrity, compatibility, or whether the imported module came from an approved environment.

Attack Path

  1. A user runs /argus or /argus test --frontend.
  2. The pytest_playwright import check fails.
  3. The Skill invokes the environment-resolved pip.
  4. The latest dependency versions and their transitive dependencies are resolved from the configured package source.
  5. Package build or installation code executes with the agent's privileges.
  6. The environment-resolved playwright command downloads Chromium artifacts.
  7. A compromised upstream release, package index, tran ...[truncated 675 chars]
Remediation
View remediation

Remediation Suggestions

  • Move dependency installation into an explicit setup command rather than performing it during normal test execution.
  • Require informed user approval before downloading or installing packages and browser binaries.
  • Pin exact reviewed versions of all direct and transitive dependencies.
  • Use a lockfile and hash verification, such as pip requirements with --require-hashes.
  • Specify an approved package index and prevent unexpected fallback indexes.
  • Create and use a dedicated project virtual environment.
  • Invoke dependencies through the selected interpreter, for example python -m pip, rather than an ambiguous pip executable.
  • Pin and verify Playwright browser revisions and downloaded artifact integrity.
  • Run installed browser components in a restricted environment with minimal filesystem and credential access.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:216
Finding

Unsafe Automatic Git Commit Amendment Based on SHA Inequality

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 216–238
Vulnerability Type: Unsafe repository history mutation
Risk Level: Medium

Vulnerable Code

bash
# Check if already pushed
LOCAL=$(git rev-parse HEAD)
REMOTE=$(git rev-parse origin/$(git branch --show-current) 2>/dev/null || echo "none")

if [ "$LOCAL" != "$REMOTE" ]; then
  # Safe to amend
  git commit --amend --no-edit -m "$(git log -1 --format='%s%n%n%b')

[Argus] Auto-enriched
Changed:
  {list of changed endpoints or files with brief description}

TESTABLE:
  endpoint: {most testable endpoint changed}
  scenario: {concrete behavior that should be verified}
  risk: {low|medium|high}"
fi

Technical Analysis

The Skill treats inequality between local HEAD and origin/<current-branch> as proof that the current commit has not been pushed. That assumption is incorrect.

The SHAs can differ when the local and remote branches have diverged, when remote-tracking references are stale, when the repository is in detached-HEAD state, when no matching remote branch exists, or when the commit was pushed to another remote or branch. If remote resolution fails, REMOTE becomes none, which guarantees inequality and therefore triggers amendment.

git commit --amend rewrites the current commit and changes its identifier. It can also invalidate cryptographic commit signatures. The generated message includes values inferred from repository content, making the resulting history mutation dependent on automated analysis rather than explicit developer review.

Attack Path

  1. The Skill analyzes the most recent commit.
  2. The repository has a missing, stale, differently named, or divergent remote-tracking reference.
  3. The local and resolved remote SHAs differ, or remote resolution returns none.
  4. The condition is treated as proof that amendment is safe.
  5. The Skill runs git commit --amend without explicit conf ...[truncated 690 chars]
Remediation
View remediation

Remediation Suggestions

  • Never amend a commit automatically; present the proposed message and require explicit user confirmation.
  • Resolve the configured upstream with @{upstream} rather than assuming origin/<branch>.
  • Fetch or clearly identify stale remote-tracking information before making a decision.
  • Determine whether HEAD is already reachable from any relevant remote reference instead of comparing two SHAs for equality.
  • Handle detached HEAD, missing upstreams, multiple remotes, and diverged histories as unsafe states.
  • Use an ancestry check such as git merge-base --is-ancestor HEAD @{upstream} as one component of the validation.
  • Prefer writing the proposed enrichment to a separate notes file or displaying it to the user.
  • Preserve signed commits by default and warn that amendment changes the commit ID and invalidates existing signatures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill lacks a clear warning that it may automatically amend commit messages, which is a sensitive operation that rewrites local history. Even if limited to pre-push checks, automatic history modification can alter provenance, surprise users, and interfere with developer workflows or policies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly states that dependencies will be installed automatically on first run, which implies the skill may modify the host environment without clear, informed user consent. In the context of an agent skill that runs tests and hooks into local development workflows, silent package installation increases supply-chain and system-modification risk, especially if packages or install commands are not pinned, previewed, or sandboxed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The phrase check this commit is ambiguous and could trigger the skill when the user intended a simple review rather than automated repository-affecting actions. The ambiguity is less severe than run tests but still problematic because the skill includes hidden state changes beyond analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Initialization writes .argus/* files and installs a persistent git hook, but the description does not prominently warn users about these side effects. Missing disclosure undermines informed consent and makes accidental repository instrumentation more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill installs a persistent post-commit hook even though its description frames it as a testing helper. Persisting code into .git/hooks creates ongoing execution on future commits and broadens the skill from one-time testing into repository instrumentation, which users may not expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is presented as a testing tool, but it also mutates git history by auto-amending commit messages. That is a materially different and higher-risk capability because it changes developer audit trails and repository state without an explicit, prominent consent step tied to each amend action.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The claim that Argus 'does not repair' is misleading because it still performs impactful repository modifications by amending commits. This mismatch can cause users to trust the skill as read-mostly or reporting-only when it actually rewrites version-control metadata.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill may run pip install and install browser binaries at runtime, causing unreviewed dependency and system-state changes. This expands the trust boundary beyond test orchestration and can introduce supply-chain, reproducibility, and environment-integrity risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Frontend execution can install packages and browser binaries, but the skill does not clearly warn about these environment changes before use. Silent dependency installation can affect system integrity, consume resources, and create policy/compliance issues on managed machines.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The primary descriptive content is presented in Chinese, which may force a specific language on users without opt-in. The file does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The phrase check this commit is ambiguous and could trigger the skill when the user intended a simple review rather than automated repository-affecting actions. The ambiguity is less severe than run tests but still problematic because the skill includes hidden state changes beyond analysis.

Content

No source excerpt is available for this finding.