ClawHub
Back to skill

Security audit

codegraph

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local code-analysis helper, with one install-documentation risk users should review before running.

Before installing, prefer a package-manager or verified download flow over piping a remote script directly into a shell. Also confirm before allowing CodeGraph to create or update .codegraph indexes, especially in private repositories, because indexes persist local source-code metadata and snippets.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation recommends `curl ... | sh`, which executes a remote script directly in the user's shell without an opportunity to inspect or verify its contents. If the upstream source, transport, or publishing pipeline is compromised, users could run arbitrary attacker-controlled code immediately; in an agent-oriented skill, this is more dangerous because users may follow installation steps with elevated trust and less scrutiny.

Static analysis

No suspicious patterns detected.