easy-code-review

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:14 PM UTC
• Version: 1.0.0

Overview

This code-review skill is mostly coherent, but its documentation and permissions create review-worthy risk around unverified CI installation and unnecessary write/process authority.

Install only if you are comfortable granting repository read and git inspection access, and avoid copying the CI curl-to-shell or unpinned global npm examples without pinning and verifying the installer. Treat file.write as overbroad for the current implementation and prefer a version that removes it or clearly scopes report-writing behavior.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:240
• Finding: Unverified Remote Script Is Executed Directly in CI## Vulnerability Details **File Location**: `README.md:240-243` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```yaml - name: Setup OpenClaw run: | # Install OpenClaw curl -fsSL https://get.openclaw.ai | sh ``` ### Technical Analysis The documented CI workflow downloads a mutable script from `https://get.openclaw.ai` and passes the response directly to a shell. It does not pin a release, store the script for inspection, verify a cryptographic digest or publisher signature, or otherwise authenticate the exact payload that will execute. HTTPS protects the connection in transit but does not protect against compromise of the remote server, domain, DNS infrastructure, publishing account, or build pipeline. Because the executable content can change after the Skill has been reviewed, the command creates a remote code-execution channel controlled by the external endpoint. This behavior is not necessary for the Skill's core Git-change analysis. A versioned and cryptographically verified installation mechanism can provide the required tool without executing mutable network content blindly. ### Attack Path 1. An attacker compromises the `get.openclaw.ai` server, its deployment pipeline, DNS configuration, or another component capable of changing the response. 2. The attacker replaces the legitimate installer with a malicious shell payload. 3. A user copies the documented workflow, or an existing CI job runs it. 4. `curl` retrieves the attacker-controlled response. 5. The pipe sends the response directly to `sh` without inspection or integrity verification. 6. The payload executes with the CI runner's privileges and can access resources made available to that job. ### Impact Assessment Successful exploitation provides arbitrary command execution in the CI runner. Depending on workflow configuration, the payload could read or modify checked-out source code, alter build outputs, tamper with gen ...[truncated 360 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | sh` pipeline from the documented workflow. 2. Install an exact, reviewed OpenClaw release from an authenticated official source. 3. Download the artifact separately and verify a pinned SHA-256 digest or trusted publisher signature before execution. 4. Fail the workflow immediately if verification does not succeed. 5. Pin CI actions and installation artifacts to immutable versions or commit digests. 6. Apply explicit minimum workflow-token permissions and avoid exposing secrets to jobs triggered by untrusted pull requests. 7. Prefer ephemeral, isolated runners; do not run unverified installation logic on persistent or privileged self-hosted runners.

T08 · Insecure Dependencies

Warning

• Location: README.md:150
• Finding: Unpinned npm CLI Is Installed Globally## Vulnerability Details **File Location**: `README.md:150-152` **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Install ClawHub CLI npm install -g clawhub-cli ``` ### Technical Analysis The installation command resolves the current package version from the npm registry rather than selecting an exact, reviewed release. It also installs the package globally. npm packages may execute lifecycle scripts during installation, so a compromised future release or compromised publisher account could execute code immediately. No version pin, lockfile, integrity value, provenance check, or publisher-verification procedure is provided. Consequently, users following the same documentation at different times may execute materially different package contents. ### Attack Path 1. An attacker compromises the package publisher, registry account, or package distribution process. 2. The attacker publishes a malicious release under the expected package name. 3. A user follows the installation instructions without specifying a version. 4. npm resolves and downloads the attacker-controlled latest release. 5. Malicious lifecycle code executes during installation, or malicious CLI behavior executes when the installed command is used. 6. Global installation makes the compromised executable available system-wide within the user's command environment. ### Impact Assessment Installation-time code can execute with the privileges of the user running npm. It may read files accessible to that account, access environment variables and developer credentials, modify user-level configuration, or install altered tooling. If the command is run with elevated privileges, the impact may become system-wide. A global package can also affect unrelated projects that subsequently invoke the same CLI.
• Remediation: ## Remediation Suggestions 1. Pin the CLI to an exact, audited version rather than installing the latest release. 2. Document the authoritative package repository and verified publisher identity. 3. Validate npm provenance and package integrity before installation. 4. Prefer a project-local, lockfile-controlled dependency or a signed, versioned official binary over a global installation. 5. Review package lifecycle scripts and use `--ignore-scripts` where installation scripts are unnecessary. 6. Avoid elevated installation privileges and execute the tool in a restricted development or CI environment.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:5
• Finding: Skill Declares Unnecessary File-Write Permission## Vulnerability Details **File Location**: `SKILL.md:5-9` **Additional Location**: `skill.json:23-28` **Vulnerability Type**: Excessive permission declaration **Risk Level**: Low ### Vulnerable Code ```yaml permissions: - file.read - file.write - git.read ``` The same capability is declared in `skill.json`: ```json "permissions": [ "file.read", "file.write", "git.read" ] ``` ### Technical Analysis The packaged analyzer reads Git change metadata by invoking fixed `git show` and `git diff` commands and writes its report to standard output. The audited Python implementation contains no project-file write operation. Therefore, `file.write` exceeds the minimum privileges required by the implemented review functionality. An excessive permission is not itself evidence that the Skill currently modifies files. It nevertheless expands the impact of any future instruction compromise, dependency compromise, or malicious update by making repository modification available to Skill behavior that only needs read access. ### Attack Path 1. A user installs or activates the Skill with its declared permissions. 2. The platform grants `file.write` even though the current analyzer does not require it. 3. The Skill's instructions, implementation, or a future dependency is subsequently compromised. 4. Attacker-controlled behavior uses the already granted write capability. 5. Accessible source files, configuration, or generated artifacts are modified under the user's authorization context. ### Impact Assessment The unnecessary capability could permit modification or deletion of files within the platform-defined writable scope. Potential effects include source-code tampering, configuration alteration, review-result manipulation, or corruption of repository contents. The practical scope depends on how OpenClaw maps `file.write` to filesystem paths. The existing analyzer itself was not found to exercise this permission.
• Remediation: ## Remediation Suggestions 1. Remove `file.write` from both `SKILL.md` and `skill.json`. 2. Retain only the read and Git capabilities required to inspect changes. 3. If report persistence is introduced later, request explicit user approval and narrowly scope write access to a designated report path. 4. Keep permission declarations synchronized across all manifests and add a release check that rejects unnecessary capability expansion.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

External Script Fetching

High

• Category: Supply Chain

Content

- name: Setup OpenClaw
        run: |
          # 安装OpenClaw
          curl -fsSL https://get.openclaw.ai | sh
      
      - name: Run Code Review
        run: |

• Confidence: 98% confidence
• Finding: The CI example downloads and executes a remote script via curl piped directly to sh, which prevents inspection and trusts the remote endpoint completely at execution time. If the server, DNS, TLS chain, or distribution path is compromised, arbitrary code will run in the CI environment with repository and secret access.

Chaining Abuse

High

• Category: Tool Misuse

Content

- name: Setup OpenClaw
        run: |
          # 安装OpenClaw
          curl -fsSL https://get.openclaw.ai | sh
      
      - name: Run Code Review
        run: |

• Confidence: 97% confidence
• Finding: The shell pipe creates an unsafe command chain where untrusted network content flows directly into command execution. In CI/CD context this is especially dangerous because it can convert a documentation example into a supply-chain compromise path affecting builds, artifacts, and potentially deployment credentials.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares only file.read, file.write, and git.read, but the implementation directly invokes an external executable via subprocess, which is an undeclared shell/process-execution capability. In agent environments, permission mismatches are dangerous because they bypass operator expectations and may permit broader command execution than the manifest advertises.

Credential Access

High

• Category: Privilege Escalation

Content

'tsconfig.json', 'tsconfig.*.json',
        '.eslintrc', '.eslintrc.*', '.prettierrc', '.prettierrc.*',
        'webpack.config.js', 'webpack.*.js', 'vite.config.*',
        '.env', '.env.*', 'config.*',
        'Dockerfile', 'docker-compose.*',
        '.gitignore', '.dockerignore'
    }

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: README 的使用示例使用了“帮我review一下最近的git commit”“审核这段代码修改”等自然语言表述，但没有给出明确的触发边界、限定上下文或排除示例。这类短语在日常协助场景中也很常见，容易让技能被过宽匹配触发。

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README declares file.write permission but does not clearly explain to users that the skill may modify local files or under what circumstances writes occur. In a code-review skill, write access is broader than expected for read-only analysis, so users may install it without understanding the modification risk.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough that ordinary discussion about reviewing code could activate the skill unintentionally. In combination with elevated permissions like file.read, file.write, and git.read, accidental activation can expose repository contents, initiate scans the user did not intend, or perform writes if later behavior uses that permission.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation states the skill depends on command execution even though the manifest does not declare such permission. This creates an unsafe trust boundary: operators may assume the skill only reads files and git state, while its instructions encourage a more powerful execution model that could later be wired in or socially induced by the host agent.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file title and content are entirely in Chinese and present the review guidance as the default operating mode for the AI code review assistant, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This Python file contains natural-language descriptions and CLI output entirely in Chinese, including the module docstring and later argument/help text and report labels. Because the skill does not offer any user opt-in or alternative locale, it imposes a specific language on users, which matches the policy violation criteria for language or locale constraints.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 获取工作区变更
                cmd = ['git', 'diff', '--numstat']
            
            result = subprocess.run(
                cmd,
                cwd=self.repo_path,
                capture_output=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 获取工作区变更
                cmd = ['git', 'diff', '--numstat']
            
            result = subprocess.run(
                cmd,
                cwd=self.repo_path,
                capture_output=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The argparse description/help strings and all printed analysis-report labels are hard-coded in Chinese. This creates a mandatory locale for interaction and output without giving the user a choice, which is a natural-language policy violation under the stated rules.

Lp4

Low

• Category: MCP Least Privilege
• Confidence: 65% confidence
• Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Lp4

Low

• Category: MCP Least Privilege
• Confidence: 65% confidence
• Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Lp4

Low

• Category: MCP Least Privilege
• Confidence: 65% confidence
• Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: For a code review assistant, file.write exceeds the stated need of reading changes and producing a report in chat or structured output. Unnecessary write access increases the blast radius if the skill is misused, compromised, or triggered unexpectedly, allowing repository files or review artifacts to be altered instead of merely inspected.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The description at L04 is written only in Chinese, which indicates a language-specific presentation without any visible opt-in or explanation that the skill is intended only for Chinese-speaking users. Under the policy rule, forcing a specific language without user choice or justification is a natural-language locale concern.

Static analysis

No suspicious patterns detected.