ClawHub
Back to skill

Security audit

Code Review Assistant Zhuyu28

Security checks for vulnerabilities and agentic risk

Overview

This is a basic code review helper with overstated capability claims, but I found no hidden access, persistence, exfiltration, or destructive behavior.

Install only if you want a lightweight review aid, not a comprehensive security or version-control review system. Treat its findings as basic suggestions and use dedicated review, test, and security tools for important code decisions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The skill description claims broad AI-powered security, bug, performance, multilingual, and version-control review capabilities that the referenced implementation reportedly does not actually provide. This is dangerous because users may rely on the skill for security review or code analysis decisions under false assumptions, leading to missed vulnerabilities, unsafe approvals, or inappropriate trust in the tool's output.

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill metadata does not declare any tool restrictions even though the implementation reportedly uses file_read and shell capabilities. Missing scope boundaries can allow the skill to access files or invoke commands beyond what a user would reasonably expect from a code review assistant, increasing the risk of data exposure or command abuse if the underlying implementation is triggered.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The usage text is broad enough that the skill may activate on routine code-sharing or general programming conversations without clear boundaries. Over-broad activation can expose more code or repository content than intended and may cause the agent to invoke file or shell-backed review behavior in contexts where the user did not explicitly request it.

Static analysis

No suspicious patterns detected.