ClawHub
Back to skill

Security audit

archmap

Security checks for vulnerabilities and agentic risk

Overview

This skill performs disclosed local architecture and impact analysis, writing reports into the target project's archmap folder without evidence of hidden exfiltration or business-code modification.

Install this only if you are comfortable with a local tool reading your project source and writing analysis artifacts under the project's archmap directory. Use a pinned or controlled Python environment for dependencies, and be cautious with the documented expert-router, gate-switch, or retro-skill-dispatcher integrations unless those local tools are present and trusted.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares no permissions while its documented behavior clearly includes shell execution, filesystem read/write, environment-dependent external tool invocation, and potentially network-backed dependency installation. This creates a transparency and least-privilege problem: users may invoke it without understanding the full capability set, increasing the risk of unintended code execution or project-wide file modification.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The top-level description frames the skill as architecture mapping, but the actual behavior expands into ETL-specific rule extraction, risk assessment, contract drift detection, and configuration analysis. That mismatch can mislead users about scope and data handling, causing them to authorize a narrower task while the skill performs broader analysis and writes more artifacts than expected.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The document repeatedly claims the skill is a 'pure analysis' agent, yet it invokes external expert-router and gate-switch workflows and persists meta-process records unrelated to direct source analysis. This undermines trust boundaries and can lead users to underestimate external command execution, cross-skill dependencies, and additional data written outside the immediate analysis scope.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The expert-routing and self-internalization features are not necessary for architecture mapping and introduce extra shell execution, data persistence, and cross-tool interaction. Unnecessary capability expansion increases attack surface and can leak project context into auxiliary logs or tools beyond what users expect for a local static analysis skill.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill writes and updates many files under the target project path, yet the description does not prominently warn users about these side effects before invocation. Hidden write behavior is dangerous in a developer tooling context because users may run it on sensitive repositories, generating or overwriting files that affect workflows, reviews, or downstream automation.

Missing User Warnings

Low
Confidence
85% confidence
Finding
Initializing SentenceTransformer with a model name can cause the library to fetch model artifacts from remote sources if they are not already cached locally. In an agent skill that may be run in sensitive or offline environments, this creates undisclosed outbound network access and potential supply-chain exposure, even though the code itself appears intended for normal functionality rather than abuse.

Unpinned Dependencies

Low
Category
Supply Chain
Content
PyYAML>=6.0
numpy>=1.24.0
sentence-transformers>=2.2.0
scipy>=1.10.0
Confidence
95% confidence
Finding
The dependency is specified with only a minimum version bound, which allows future unreviewed releases to be installed. This creates supply-chain and reproducibility risk because a later breaking or compromised release could be pulled into builds without explicit approval.

Unpinned Dependencies

Low
Category
Supply Chain
Content
PyYAML>=6.0
numpy>=1.24.0
sentence-transformers>=2.2.0
scipy>=1.10.0
Confidence
95% confidence
Finding
Using only a lower-bound version for numpy permits automatic installation of any newer release, including versions that have not been security-reviewed for this skill. That increases supply-chain exposure and can also cause non-reproducible environments across deployments.

Unpinned Dependencies

Low
Category
Supply Chain
Content
PyYAML>=6.0
numpy>=1.24.0
sentence-transformers>=2.2.0
scipy>=1.10.0
Confidence
96% confidence
Finding
sentence-transformers is unpinned beyond a minimum version, so future releases and transitive dependency changes may be introduced silently during installation. In an agent skill context, ML-related packages often have large dependency trees, which slightly increases supply-chain uncertainty even though this file alone does not show active exploitation.

Unpinned Dependencies

Low
Category
Supply Chain
Content
PyYAML>=6.0
numpy>=1.24.0
sentence-transformers>=2.2.0
scipy>=1.10.0
Confidence
95% confidence
Finding
scipy is also specified with a minimum version only, allowing builds to consume newer releases without explicit review. This is dangerous mainly from a dependency integrity and reproducibility standpoint rather than as an immediate direct exploit in this file.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 安装：pip3 install -r requirements.txt
#
# 必需依赖（diff / lite / sync 等纯算法模式也依赖，必须安装）
PyYAML>=6.0
numpy>=1.24.0
scipy>=1.10.0
Confidence
93% confidence
Finding
The dependency is specified with a lower bound only, so future installs may resolve to different upstream versions over time. This creates supply-chain and reproducibility risk: a later incompatible or compromised release could be pulled into the environment without review.

Unpinned Dependencies

Low
Category
Supply Chain
Content
#
# 必需依赖（diff / lite / sync 等纯算法模式也依赖，必须安装）
PyYAML>=6.0
numpy>=1.24.0
scipy>=1.10.0

# 可选依赖（仅向量召回增强）
Confidence
93% confidence
Finding
Using an unpinned numpy version allows installation of any newer release satisfying the minimum bound, which weakens build reproducibility and increases exposure to malicious or defective upstream releases. In security-sensitive automation, this can introduce unexpected behavior or dependency-chain compromise.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 必需依赖（diff / lite / sync 等纯算法模式也依赖，必须安装）
PyYAML>=6.0
numpy>=1.24.0
scipy>=1.10.0

# 可选依赖（仅向量召回增强）
# 缺失时 VectorRecognizer 自动回退到本地确定性哈希向量化：
Confidence
93% confidence
Finding
A minimum-only version specifier for scipy means deployments may silently consume newer versions than the author tested. That expands the attack surface for dependency confusion, compromised releases, or breaking changes affecting the skill's execution path.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# 缺失时 VectorRecognizer 自动回退到本地确定性哈希向量化：
# 功能完整可用，向量匹配精度略降；增量影响面分析仍可通过
# 关键词硬匹配与路由闭包等确定性信号召回受影响模块。
sentence-transformers>=2.2.0
Confidence
88% confidence
Finding
The optional dependency is also unpinned, so environments that choose to install it may fetch arbitrary newer versions. Even though it is optional, it still introduces supply-chain risk and non-reproducible behavior when vector-recall functionality is enabled.

Static analysis

No suspicious patterns detected.