Security audit

rabbit-claude-md

Security checks for vulnerabilities and agentic risk

Overview

The main memory-file auditor is mostly coherent, but the package also includes under-disclosed hook and rewrite capabilities that can affect commit or PR text and send prose to a configured model endpoint.

Review this carefully before installing. It is reasonable for a memory-file auditor to read repository context and propose edits, but do not enable any Claude hook integration unless you explicitly want it to inspect prose writes and rewrite commit or PR command text. If you use --apply-model, confirm the endpoint yourself because document passages and any configured RABBIT_MODEL_API_KEY may be sent there.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no permissions even though its documented workflow invokes shell commands, reads repository files, may write edits after approval, consults environment variables, and can optionally contact a remote model endpoint. This creates a trust-boundary mismatch: operators may approve or auto-enable the skill believing it is low-privilege when it can perform materially more powerful actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The advertised purpose is narrow, but the documented and bundled behavior appears much broader, including general document scanning, style enforcement, commit/PR rewriting, hook handling, and optional remote-model rewriting. That mismatch can mislead users and security tooling about what will run, increasing the chance that powerful features are invoked in contexts where they were not expected or reviewed.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata claims this package audits and restructures CLAUDE.md and AGENTS.md memory files, but the code is a general Claude hook runner that alters session behavior and post-write scanning. That mismatch is dangerous because it conceals materially different capabilities from users and reviewers, undermining informed consent and increasing the chance of unauthorized persistence or behavior modification in the agent environment.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code rewrites git commit messages and GitHub PR bodies during PreToolUse, which is a powerful capability unrelated to the stated memory-file maintenance purpose. Hidden modification of user-authored commit/PR content can suppress provenance, alter audit trails, and manipulate what gets recorded in version control or sent to remote services without transparent authorization.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The hook scans arbitrary prose files on write, not just CLAUDE.md and AGENTS.md as the manifest suggests. In context, this broader monitoring is more dangerous because it silently expands collection and influence over user content beyond the declared memory-file maintenance scope, potentially exposing unrelated documents to analysis and policy enforcement.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The module docstring openly describes a hook runner for session, write, and shell-command events, directly contradicting the manifest's benign memory-file auditing description. This discrepancy is a strong indicator of deceptive packaging: even if some individual behaviors are not independently exploitable, disguising active hook behavior inside a differently described skill materially increases supply-chain and trust-boundary risk.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This module does more than audit or plan: `run()` and `rewrite_unit()` actively send document passages to a model endpoint for rewriting. Even though the code includes safety gates and validation, the capability exceeds the declared skill scope, which increases the risk of unintended data egress and of a skill performing higher-impact actions than a user or policy expects.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The prompting and guidance define a generic prose-rewriting engine rather than logic narrowly tailored to CLAUDE.md/AGENTS.md maintenance. Broad text-rewrite capability creates a reusable primitive that can be applied to arbitrary prose, increasing the chance of out-of-scope modification, sensitive-content transmission, or policy bypass through repurposing.

Context-Inappropriate Capability

High

Confidence: 86% confidence
Finding: The file can send document passages to an OpenAI-compatible model endpoint via --apply-model. In a skill advertised for local memory-file auditing, hidden or indirect network egress materially increases risk because sensitive repository content may be transmitted to a remote service if the feature is invoked or preconfigured through local endpoint settings.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger text uses broad, everyday phrases like 'improve', 'clean up', 'fix it', and similar open-ended language, making accidental activation more likely outside the narrow intended use case. When combined with shell, file-editing, and optional network/model-backed behavior, overbroad invocation increases the risk of unintended scans, edits, or disclosure of repository content to downstream components.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/claude_check.py:887

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/rwlib/voices.py:688

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/rwlib/endpoint.py:54