ClawHub
Back to skill

Security audit

rabbit-rewrites

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does disclosed prose scanning and rewriting, but it includes an under-documented Claude hook that can automatically change commit and PR commands.

Install only if you want a prose scanner/rewriter with optional model-endpoint use. Review scripts/claude_hook.py carefully before wiring it into Claude Code hooks, because it can change commit and PR messages. Prefer --model-plan and --stdout with diff before --write, use local or HTTPS endpoints, and keep API keys in dedicated RABBIT_* environment variables rather than config files.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The declared purpose narrows the skill to local-model rewriting, but the documented and inferred behavior appears substantially broader, including scanning, deterministic file modification, hook handling, PR/commit message rewriting, DOCX parsing, SARIF emission, and prompt-injection detection. This mismatch is dangerous because operators may approve or invoke the skill under a limited trust assumption while it actually has broader automation and content-processing reach, increasing the chance of unintended file changes, network use, or workflow integration in sensitive environments.

Context-Inappropriate Capability

Medium
Confidence
80% confidence
Finding
The hook actively rewrites Bash tool input for git commit and gh pr create before execution, which means the skill can alter user-intended commands and outbound text at a privileged interception point. In this skill context, that is more dangerous because the advertised purpose is prose rewriting via a local model, not shell-command mediation, so users may not expect their commit or PR content to be silently modified.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/rwlib/voices.py:688

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/rwlib/endpoint.py:54