ClawHub
Back to skill

Security audit

Zero2ai Security Audit

Security checks for vulnerabilities and agentic risk

Overview

This security-audit skill is mostly purpose-aligned, but it can copy detected secrets into logs and has fail-open checks that can give users false confidence.

Review this skill before installing in any workflow that handles real credentials. If used, treat its output as sensitive, avoid saving JSON or terminal logs where others can read them, do not rely on a clean exit as proof that all files were scanned, and replace the hardcoded Aladdin path and reporting instruction with your own local configuration.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.py:326
Finding

MEDIUM findings do not block documented publishing workflows

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.py:234
Finding

The node_modules detection rule is unreachable

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.py:248
Finding

Git command failures are silently reported as clean scans

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.py:234
Finding

Unreadable files are silently omitted from the audit

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit.py:190
Finding

Detected secrets are exposed in console and JSON output

Content
View full analysis
40 else ''), }) ``` ```python if item['value_preview']: print(f" → Value: {item['value_preview']}") print(f" → {item['match'][:100]}") ``` JSON output serializes the same sensitive fields: ```python print(json.dumps({'findings': unique, 'summary': {k: len(v) for k, v in grouped.items()}}, indent=2)) ``` ### Technical Analysis When a secret is detected, the scanner stores up to the first 40 characters of the matched value and up to 120 characters of the complete source line. Human-readable output prints the value preview and up to 100 characters of the line. JSON mode serializes both fields. Many credentials are 40 characters or shorter, so `value_preview` can disclose the full secret. Even when a token is longer, the source-line excerpt may contain the full value or enough material to facilitate misuse. Secret scanners should minimize replication of sensitive values because CI logs, terminal captures, Agent transcripts, and generated audit artifacts often have broader retention and access than the source file. ### Attack Path 1. A repository contains a credential matching one of the scanner's secret rules. 2. The scanner identifies the credential. 3. It copies the value and containing line into the finding object. 4. Human-readable or JSON output is captured by CI, an orchestration platform, a terminal logger, or an Agent transcript. 5. A user with access to those logs retrieves the complete secret or a substantial usable prefix. 6. If the credential ...[truncated 506 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: zero2ai-security-audit
description: Security auditing for git commits, repos, and skills before publishing. Run automatically before any `git commit`, `git push`, or `clawhub publish`. Detects hardcoded secrets, API keys, tokens, absolute paths, committed node_modules, .env files, and other sensitive patterns. Use when reviewing code for security issues, pre-publishing skills, or investigating a potential secret exposure.
---

# Security Audit

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 121)May include surrounding context.

python
---
name: zero2ai-security-audit
description: Security auditing for git commits, repos, and skills before publishing. Run automatically before any `git commit`, `git push`, or `clawhub publish`. Detects hardcoded secrets, API keys, tokens, absolute paths, committed node_modules, .env files, and other sensitive patterns. Use when reviewing code for security issues, pre-publishing skills, or investigating a potential secret exposure.
---

# Security Audit

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/audit.py (reported line 102)May include surrounding context.

python
{
        "id": "refresh-token",
        "severity": "MEDIUM",
        "description": "Possible refresh/access token value",
        "regex": r'(Atzr|Atza|ATNR)\|[A-Za-z0-9+/\|]{40,}',
    },
    {

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill instructs users to run a local Python script and references capabilities consistent with shell, file access, and environment interaction, but it does not declare any explicit tool scope or permissions boundary. This can cause the skill to operate with broader-than-expected authority, reducing transparency and increasing the chance of unsafe execution in automation contexts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/audit.py (reported line 253)May include surrounding context.

python
def scan_git_files(mode='staged'):
    if mode == 'staged':
        result = subprocess.run(['git', 'diff', '--cached', '--name-only'], capture_output=True, text=True)
    else:
        result = subprocess.run(['git', 'diff', 'HEAD~1', '--name-only'], capture_output=True, text=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/audit.py (reported line 255)May include surrounding context.

python
if mode == 'staged':
        result = subprocess.run(['git', 'diff', '--cached', '--name-only'], capture_output=True, text=True)
    else:
        result = subprocess.run(['git', 'diff', 'HEAD~1', '--name-only'], capture_output=True, text=True)

    files = [f.strip() for f in result.stdout.split('\n') if f.strip()]
    all_findings = []

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation reveals a specific absolute local path in a user's home directory, which unnecessarily discloses workstation structure and username information. While not directly exploitable on its own, such environmental details can aid targeting, social engineering, or path-dependent attacks when combined with other information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The instruction 'Report to Aladdin immediately' is a natural-language policy constraint embedded in the skill documentation. It hard-codes an organization-specific escalation target without documenting context, alternatives, or opt-in, which can violate policy expectations when the skill is reused in other environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code invokes external git commands via subprocess.run to inspect staged or last-commit files. Although the operation is non-destructive, the file provides no inline comment, log output, or other user disclosure around this shell execution path.

Content

No source excerpt is available for this finding.