Architecture Consistency Guardian

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:30 AM UTC
• Version: 2.0.1

Overview

This skill is a disclosed local code-consistency workflow with helper scanners, not a hidden or destructive package.

Install from the reviewed ClawHub artifact when possible, or pin and verify any npx/manual install source. When using the skill, review the proposed affected-file plan before edits and keep scans limited to the relevant project directories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:121

Finding

Unpinned Remote Installation Chain

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 121–125
Vulnerability Type: Unpinned third-party installation dependencies
Risk Level: Medium

Vulnerable Code

bash

clawhub install architecture-consistency-guardian

bash

npx skills add upsightx/architecture-consistency-guardian

Technical Analysis

The documented installation commands do not pin the installer package or target Skill to an immutable version, release, commit, or integrity hash. In particular, npx may retrieve and execute the currently published skills package before it installs content from the mutable upsightx/architecture-consistency-guardian reference.

Consequently, the code executed during installation can differ from the artifact reviewed in this audit. A package-registry compromise, repository compromise, ownership transfer, or malicious future release could turn these otherwise legitimate commands into a supply-chain delivery mechanism.

The audited project itself contains no confirmed malicious scripts, network retrieval logic, credential access, persistence, or privilege-escalation behavior. The risk arises specifically from the mutable external installation chain documented in the README.

Attack Path

1. An attacker compromises the package registry entry, installer package, upstream repository, maintainer account, or mutable release reference.
2. The attacker publishes a modified installer or Skill payload under the expected name.
3. A user follows one of the documented commands without independently verifying the resolved version or content.
4. The package runner downloads and executes or installs the attacker-controlled content.
5. The malicious payload runs with the permissions of the invoking user and can access resources available to that account.

Impact Assessment

Successful exploitation could provide attacker-controlled code with the invoking user’s privileges. Depending on that user’s environment, the scope could inc ...[truncated 355 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npx installer to an explicitly reviewed version rather than resolving the latest release.
2. Pin the target Skill to an immutable commit digest or signed release tag.
3. Publish expected cryptographic hashes or signature-verification instructions.
4. Use package-manager lockfiles and integrity metadata where supported.
5. Recommend downloading and reviewing the pinned artifact before execution.
6. Document trusted publisher identities and a procedure for verifying repository and package ownership.
7. Avoid running installation commands with elevated privileges; install using a least-privileged account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is for a decision/support skill that should activate during broad refactoring or contract-drift remediation and help ensure global consistency before code changes. The supplied code does not enforce consistency, modify code, inspect references semantically, or reason about architecture. It simply scans files under a directory for literal or regex matches and reports them. While searching for 'legacy residue' is thematically related to cleanup and unification, the actual implementation is only a generic scanning utility, not the described cross-file consistency enforcement skill. Therefore the description materially overstates and mischaracterizes the code's primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a proactive review/enforcement skill for deciding when broad, system-wide code changes are needed across modules, schemas, configs, and contracts. The actual code is much narrower: it only consumes previously generated JSON from grep_legacy.py or scan_contract_drift.py, normalizes formats, aggregates findings, and outputs summaries in text or JSON. While the domain overlaps with legacy cleanup and contract drift, the code does not enforce consistency, analyze code changes themselves, or trigger on the broad set of refactoring scenarios described. Its primary purpose is impact summarization/reporting, so the description materially overstates and mischaracterizes the behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is written as direct operational guidance in Chinese, and the README does not indicate that other languages are supported or that Chinese is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs the agent to read, write, and run shell-based scans, but it declares no explicit tool restrictions. In an adversarial or mis-scoped invocation, this can grant broader-than-expected filesystem and command access, increasing the chance of unintended modification or abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger list explicitly includes Chinese phrases alongside English ones, but the document does not state that language is optional or user-selectable. This can create a locale-policy issue because activation expectations are tied to specific languages without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/output_template.md (reported line 76)May include surrounding context.

md

- ❌ "Fixed the issue." (no detail)
- ❌ "Refactored the module." (no scope)
- ❌ "Updated all references." (no proof)
- ❌ "Everything should be consistent now." (no verification)

Every claim must be backed by a concrete action or check result.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · scripts/grep_legacy.py (reported line 85)May include surrounding context.

python

def scan_directory(directory, compiled_patterns, extensions, ignore_dirs, use_regex=False):
    """Walk directory and scan files.

    Returns:
        tuple[list[dict], list[dict]]: results, errors

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_cli_workflows.py (reported line 12)May include surrounding context.

python

def run_cli(args, *, cwd=None, input_text=None):
    return subprocess.run(
        [sys.executable, *args],
        cwd=cwd or REPO_ROOT,
        input=input_text,

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md

4. **Never keep a fallback silently** — if it stays, it gets a COMPAT comment and a reason.
5. **Never report "fixed"** without stating what residue remains.
6. **Never skip doc/comment updates** when code behavior changes.
7. **Always expand scope** when the change touches: config vars, env vars, DB paths,
   table/column names, status fields, status values, event names, service entry points,
   fallback logic, or documented main paths.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.