安全决策报告
ClawCode Lens
The skill's three local scripts (explain.py, security_scan.py, improve.py) are clean static analyzers with no malicious behavior, but SKILL.md documents an undeclared paid deep-scan code path that uploads source files to an external API — directly contradicting the '100% local, no network calls' claim.
最直接的威胁证据
高危 文档欺骗
Local-only claim contradicts documented external upload path SKILL.md prominently states '100% lokal — ingen netværkskald, ingen API-nøgle' but immediately after includes a paid deep-scan option that 'uploads your code + costs per call' to an external API. The scripts directory does not contain code_scan.py, meaning the external upload feature is either missing or unimplemented — but it is still advertised. This creates a false sense of security.
SKILL.md:36 为什么得出这个结论
1/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
复核
隐藏执行与外联
提取到 2 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 0 步攻击链，另有 1 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Doc-to-code mismatch (critical signal) +20
SKILL.md advertises '100% lokal — ingen netværkskald, ingen API-nøgle' but also documents a paid deep-scan path that uploads source code externally
Undeclared external data transfer +15
The paid deep-scan path in SKILL.md (referencing scripts/code_scan.py) is not implemented in the delivered scripts and has no privacy policy or consent flow
Filesystem access to arbitrary user files +5
All three scripts read any file path passed as an argument, which is expected behavior for a code-analysis tool but worth noting
No malicious code in delivered scripts +-5
All three Python scripts (explain.py, security_scan.py, improve.py) are straightforward static analyzers — no network calls, no obfuscation, no credential access
最关键的证据
高危 文档欺骗
Local-only claim contradicts documented external upload path
SKILL.md prominently states '100% lokal — ingen netværkskald, ingen API-nøgle' but immediately after includes a paid deep-scan option that 'uploads your code + costs per call' to an external API. The scripts directory does not contain code_scan.py, meaning the external upload feature is either missing or unimplemented — but it is still advertised. This creates a false sense of security.
SKILL.md:36 Either remove the external deep-scan documentation entirely or add a clear, prominent disclosure that this path sends user code to an external service, with links to the service's privacy policy and data handling terms.
中危 文档欺骗
Referenced script code_scan.py does not exist in delivered package
SKILL.md references 'python3 scripts/code_scan.py app.py' as the paid deep-scan entry point, but scripts/code_scan.py is absent from the file tree. This could indicate an unimplemented feature left in the documentation, or a build/packaging error.
SKILL.md:36 Either implement code_scan.py with the external upload feature and declare it properly, or remove the reference entirely to avoid misleading users about capabilities.
低危 敏感访问
Arbitrary file system read access not explicitly scoped
All three scripts (explain.py, security_scan.py, improve.py) accept an arbitrary file path as input and read it entirely. While this is expected for a code-analysis tool, the capability is not declared in SKILL.md's capability model. A malicious actor could pass sensitive file paths.
scripts/security_scan.py, scripts/explain.py, scripts/improve.py Declare filesystem:READ in the skill's allowed-tools mapping and document that the tool only processes user-specified code files, not system directories.
声明能力 vs 实际能力
文件系统 通过
声明 READ
→ 推断 READ
All three scripts: open(path, encoding='utf-8', errors='replace') 网络访问 通过
声明 NONE
→ 推断 UNKNOWN
SKILL.md line ~36: '// 2) Deep scan (PAID call — uploads your code + costs per call)' — external upload not present in code but documented 命令执行 通过
声明 NONE
→ 推断 NONE
No subprocess or shell invocation in any script 环境变量 通过
声明 NONE
→ 推断 NONE
No os.environ access in any script 可疑产物与外联
中危 外部 URL
https://clawhub.ai/user/northcap-group skill-card.md:9
中危 外部 URL
https://clawhub.ai/northcap-group/skills/clawcode-lens skill-card.md:35
依赖与供应链
没有结构化依赖告警。
文件构成
6 个文件 · 315 行
Python 3 个文件 · 180 行Markdown 2 个文件 · 130 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Local-only claim contradicts documented external upload path · Referenced script code_scan.py does not exist in delivered package
skill-card.md https://clawhub.ai/user/northcap-group · https://clawhub.ai/northcap-group/skills/clawcode-lens
其他文件 · explain.py · improve.py · security_scan.py · _meta.json
安全亮点
All three Python scripts are simple, readable static analyzers with no obfuscation or anti-analysis techniques
No network calls, no subprocess invocations, no credential harvesting in any delivered script
security_scan.py explicitly notes that scanned code is never executed — it is a read-only pattern matcher
No use of eval(), exec(), base64 decode, or other code execution techniques on scanned input
No access to sensitive paths like ~/.ssh, ~/.aws, .env, or OS credential stores
skill-card.md correctly identifies and warns about the doc deception risk independently