ClawHub
Back to skill

Security audit

env-var-audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local environment-variable and hardcoded-secret scanner, with no evidence of hidden execution, exfiltration, or destructive behavior.

Install from the reviewed ClawHub/package artifact when possible. If using the README curl command, pin it to a specific commit and verify the file before placing it in a persistent agent skills directory. Run the scanner only on project directories you intend to audit, since it reads source files and may surface secret-looking strings in terminal or JSON output.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to fetch a Python script directly from a remote URL and execute it locally, but provides no integrity verification, pinning, or safety warning. This creates a software supply-chain risk: if the repository, branch, or network path is compromised, users may run attacker-controlled code.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

Install & try

bash
mkdir -p ~/.claude/skills/env-var-audit/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/env-var-audit/scripts/env_var_audit.py -o ~/.claude/skills/env-var-audit/scripts/env_var_audit.py
python ~/.claude/skills/env-var-audit/scripts/env_var_audit.py --help

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

Install & try

bash
mkdir -p ~/.claude/skills/env-var-audit/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/env-var-audit/scripts/env_var_audit.py -o ~/.claude/skills/env-var-audit/scripts/env_var_audit.py
python ~/.claude/skills/env-var-audit/scripts/env_var_audit.py --help

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The instructions place a remotely downloaded Python script into a persistent agent skills directory, causing the code to remain available across future sessions. Persistent placement increases the blast radius of a compromised or malicious script because it may be invoked later as trusted local tooling.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

Install & try

bash
mkdir -p ~/.claude/skills/env-var-audit/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/env-var-audit/scripts/env_var_audit.py -o ~/.claude/skills/env-var-audit/scripts/env_var_audit.py
python ~/.claude/skills/env-var-audit/scripts/env_var_audit.py --help

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

This Chinese-language installation block repeats the same persistence pattern: downloading remote code into a long-lived skill directory. In the context of agent skills, persistent installation is more dangerous because future automated use may implicitly trust the retained script.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

安装即试

bash
mkdir -p ~/.claude/skills/env-var-audit/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/env-var-audit/scripts/env_var_audit.py -o ~/.claude/skills/env-var-audit/scripts/env_var_audit.py
python ~/.claude/skills/env-var-audit/scripts/env_var_audit.py --help

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The top-level description and display name are presented primarily in Chinese, and the file positions Chinese as the default user-facing locale even though an English section exists later. This can violate a language/locale policy when the skill does not explicitly offer user opt-in or state how language selection is handled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file presents all natural-language guidance in Chinese and does not indicate that users or agents may choose another language. This can violate language/locale policy requirements when no opt-in or documented regional constraint is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This Python file contains comments, argparse descriptions, error messages, and console output exclusively in Chinese, including the main user-facing strings at L52-L59 and L88-L109. Because the skill does not provide a user opt-in or configurable locale, it violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
README.md:37