Clean Code Review

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 1.0.0

Overview

This is a clean-code guidance skill with no hidden runtime behavior, though its documented install commands use mutable remote sources users should verify.

Before installing, prefer a pinned ClawHub/package version or verify the exact package/repository revision you are installing. The skill itself is ordinary code-quality guidance, but the documented npx commands can execute whichever remote installer version is current at install time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Mutable npm Package Execution Through an Unpinned Installation Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install clean-code

Technical Analysis

The installation instructions invoke npx with the mutable @latest tag. npx may download and execute package code, including package lifecycle behavior, under the privileges of the user running the command.

Because @latest does not identify an immutable, audited version, the package executed in the future may differ from the package available during this audit. The command also provides no integrity checksum or other mechanism for verifying that the downloaded package is the expected artifact.

Exploitation requires the user to run the documented installation command and an attacker to gain control over, replace, or compromise the relevant upstream package or publishing account.

Attack Path

1. An attacker compromises the upstream package, package publisher, release process, or registry account.
2. The attacker publishes a malicious version and assigns it to the latest distribution tag.
3. A user follows the documented command.
4. npx retrieves the attacker-controlled package version.
5. Malicious package or lifecycle code executes with the installing user's privileges.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npx. Depending on that user's permissions and environment, the malicious package could access project files, source code, user-readable credentials, environment variables, and other resources available to the process. The potential scope is the local user account and any systems or services reachable using that account's credentials.

This project does not itself contain the malicious payload; the risk arises from executing mutable third-party content during installation.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Verify the selected package version and publisher before documenting it.
• Use package-manager integrity verification and a lockfile where supported.
• Prefer installation methods that do not automatically execute unreviewed lifecycle scripts.
• Document the expected artifact checksum or signature and require verification before execution.
• Periodically re-audit the pinned release before updating the documented version.

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned npm and GitHub Sources in README Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 24–33
Vulnerability Type: Mutable third-party dependency and repository execution
Risk Level: Medium

Vulnerable Code

bash

npx add https://github.com/wpank/ai/tree/main/skills/testing/clean-code

bash

npx clawhub@latest install clean-code-review

Technical Analysis

Both installation alternatives rely on mutable external dependencies.

The first command invokes an unpinned npm package named add through npx and passes it a GitHub URL referencing the mutable main branch of a personal repository. Neither the npm package version nor the Git commit is pinned. Consequently, both the installer and the content being installed may change after this project has been reviewed.

The second command uses the mutable @latest npm distribution tag. It therefore does not guarantee that users will execute the same clawhub package version evaluated by the project author or auditor.

Neither command supplies an integrity checksum, cryptographic signature, immutable commit identifier, or equivalent verification control. The project metadata and documentation also use inconsistent names and versions—clean-code-review version 1.0.0 in _meta.json, clean-code version 2.0 in SKILL.md, and differing installation slugs—which can make it harder for users to verify that they are installing the intended artifact. This inconsistency is not independently a vulnerability but increases provenance ambiguity.

Attack Path

GitHub installation path:

1. An attacker compromises the npm package named add, its publisher, or its release process; alternatively, the attacker compromises the referenced GitHub account or repository.
2. The attacker publishes malicious installer behavior or modifies content on the mutable main branch.
3. A user runs the README installation command.
4. npx retrieves and executes the current npm package, whic ...[truncated 1149 chars]

Remediation

View remediation

Remediation Suggestions

• Do not invoke an unversioned package such as npx add.
• Pin every npm package to an exact, reviewed version rather than using @latest.
• Replace the GitHub main branch URL with an immutable, reviewed commit hash or signed release artifact.
• Publish installation artifacts through a trusted registry with provenance attestations and integrity metadata.
• Provide cryptographic checksums or signature-verification instructions for downloaded artifacts.
• Disable or explicitly review package lifecycle scripts before installation where the package manager permits it.
• Align the package name, Skill slug, and version across README.md, SKILL.md, and _meta.json so users can reliably verify provenance.
• Re-audit and deliberately update pinned versions rather than allowing installation targets to change automatically.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

md

| [Code Smells](references/code-smells.md) | Classic code smells catalog with detection patterns — Bloaters, OO Abusers, Change Preventers, Dispensables, Couple

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/refactoring-catalog.md (reported line 83)May include surrounding context.

md

1. Create new function named after what it does (not how)
2. Copy the code fragment to the new function
3. Pass any needed variables as parameters
4. Replace the original code with a call to the new function

---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The README instructs users to run a remote package command via npx add without pinning a specific immutable version or commit. That creates a supply-chain risk because future changes to the referenced package or repository could cause users to fetch and execute unexpected code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The command npx clawhub@latest install clean-code-review explicitly uses @latest, which is mutable and causes users to execute whatever version is current at install time. If the package is compromised or a breaking/malicious release is published, users may run attacker-controlled code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/testing/clean-code .cursor/skills/clean-code

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/testing/clean-code .claude/skills/clean-code

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/testing/clean-code ~/.claude/skills/clean-code

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: clean-code
model: standard
category: testing
description: Pragmatic coding standards for writing clean, maintainable code — naming, functions, structure, anti-patterns, and pre-edit safety checks. Use when writing new code, refactoring existing code, reviewing code quality, or establishing coding standards.
version: 2.0

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md

4. **NEVER write functions longer than 20 lines** — extract sub-functions until each does one thing
5. **NEVER nest deeper than 2 levels** — use guard clauses, early returns, or extract functions
6. **NEVER use magic numbers or strings** — define named constants with clear semantics
7. **NEVER edit a file without checking what depends on it** — broken imports and missing updates are the most common source of bugs in multi-file changes
8. **NEVER leave a task with failing lint or type checks** — fix all errors before marking complete

---

Static analysis

No suspicious patterns detected.