Security audit
Security checks for vulnerabilities and agentic risk
The skill content is ordinary clean-code guidance, but its installation instructions use mutable unpinned remote commands and one README command names a different skill.
Review the install path before using this skill. Prefer a pinned ClawHub version or an audited local checkout, and verify whether you intend to install `clean-code` rather than `clean-code-review`. After installation, expect the skill to influence coding/refactoring style in the selected project or global agent environment.
README.md:23Mutable Remote Source Passed to an Unpinned npx Package
README.md:29Installation Instructions Execute Unpinned Latest-Version Packages
Referenced artifact was not completely inspected
| [Code Smells](references/code-smells.md) | Classic code smells catalog with detection patterns — Bloaters, OO Abusers, Change Preventers, Dispensables, Couple
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
1. Create new function named after what it does (not how)
2. Copy the code fragment to the new function
3. Pass any needed variables as parameters
4. Replace the original code with a call to the new function
---
The README instructs users to execute a remote package/installer command via npx add without pinning to a specific immutable version or commit. This creates a supply-chain risk because the content fetched at install time can change, allowing a compromised upstream package, repo, or tag to execute unexpected code on the user's machine.
Using npx clawhub@latest install clean-code-review explicitly tracks the moving latest release, so users will execute whatever code is published most recently. If the package is compromised or a bad release is pushed, installation can run attacker-controlled code in the local environment.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
From your project root:
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/testing/clean-code .cursor/skills/clean-code
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
From your project root:
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/testing/clean-code .claude/skills/clean-code
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/testing/clean-code ~/.claude/skills/clean-code
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
---
name: clean-code
model: standard
category: testing
description: Pragmatic coding standards for writing clean, maintainable code — naming, functions, structure, anti-patterns, and pre-edit safety checks. Use when writing new code, refactoring existing code, reviewing code quality, or establishing coding standards.
version: 2.0
The description says the skill should be used for writing new code, refactoring, reviewing code quality, or establishing coding standards, which are broad triggers that could activate across many ordinary development tasks. Overly broad activation increases the chance this skill influences tasks outside its narrow intended scope, potentially overriding more task-specific safeguards or introducing unintended autonomous behavior in coding workflows.
The installation command uses npx clawhub@latest install clean-code, which fetches and executes the latest package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious version is published, users of the skill could execute untrusted code during installation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
4. **NEVER write functions longer than 20 lines** — extract sub-functions until each does one thing
5. **NEVER nest deeper than 2 levels** — use guard clauses, early returns, or extract functions
6. **NEVER use magic numbers or strings** — define named constants with clear semantics
7. **NEVER edit a file without checking what depends on it** — broken imports and missing updates are the most common source of bugs in multi-file changes
8. **NEVER leave a task with failing lint or type checks** — fix all errors before marking complete
---
This markdown file includes example code that performs safety-relevant actions such as charging via Stripe, writing orders to a database, sending email, and mutating inventory. Under the markdown-file criteria, the description does not provide any warning that these behaviors affect external systems or user data, so readers could reuse the example without seeing disclosure of those impacts.
No suspicious patterns detected.