ClawHub
Back to skill

Security audit

Code Review — Multi-Dimensional Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only code review skill with disclosed source-reading and subagent review behavior, but no install-time code, persistence, or destructive actions.

Install this if you want a structured, subagent-heavy code review workflow. Before using it on private code, confirm the review scope and expect source fetching, multiple subagents, and Chinese-formatted report sections.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The skill advertises very broad trigger phrases such as 'review this release', 'audit this codebase', and 'check this PR for issues', which are plausible in ordinary developer conversations and could cause unintended invocation. In an agent environment, accidental activation can expose repository contents to unnecessary processing, trigger costly subagent fan-out, or cause the agent to perform review actions when the user did not explicitly request this skill.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Anti-Patterns (avoid)

- ❌ Filing an issue based on release notes alone (always verify against source)
- ❌ Accepting a docstring claim without checking the implementation
- ❌ Using "I think" / "probably" / "seems like" — every finding is Confirmed or it's not a finding
- ❌ Leaving severity as "TBD" — classify immediately using the rubric
- ❌ Mentioning an issue in prose without filing it in the structured output table
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
This markdown specification hard-codes Chinese field labels such as '结论', '源码证据', '风险场景', and '修复建议' for every issue report. That imposes a specific language/locale on users and downstream agents without offering opt-in, alternatives, or a documented reason for the locale restriction.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The summary table and priority matrix prescribe Chinese-only column names like '问题', '来源(审计维度)', '根因(一行)', '优先级', '工作量', and '影响范围'. This is a natural-language policy concern because it forces a specific locale in the generated output rather than offering a user-selectable language.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The instruction "用中文输出" forces a specific language for subagent responses. This is a natural-language policy concern because the file does not provide user opt-in, alternatives, or a documented region-specific justification for requiring Chinese.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The line requires output in Chinese for the simplicity subagent template, again imposing a fixed language choice. Because no alternative, opt-in, or documented necessity is provided, this violates the language/locale policy criteria.

Static analysis

No suspicious patterns detected.