argus1@ 1.0.4

github.com/clawhub.ai/argus1
Verdict: Generally safe
0 critical0 high3 medium
B
SCORE 75 / 100
$skillox install argus1Soon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.

Why grade B?

score · 75 / 100

The current grade reflects 3 medium findings (3+ MEDs → B).

0 CRIT0 HIGH3 MED0 LOW
To reach a higher grade
  • A
    Reach Atarget score 95

    Resolve 1 of 3 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Latest scan findings

Scan crawl-x4cn15i5y66bzsc04fpybpqe · Thu, 28 May 2026 16:04:12 GMT · 3ms

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 125CWE-78
▾
123PYTHON_RULES = [
124 ("PY001", "critical", "security", r"\beval\s*\(", "eval() executes arbitrary code — extremely dangerous with user input.", "Use ast.literal_eval() for safe evaluation of literals."),
125 ("PY002", "critical", "security", r"\bexec\s*\(", "exec() executes arbitrary strings as Python code.", "Refactor to avoid dynamic code execution."),← spawns a subprocess outside declared capabilities
126 ("PY003", "critical", "security", r"\bpickle\.loads?\s*\(", "pickle.load() can execute arbitrary code when deserialising untrusted data.", "Use json.loads() or a safe serialisation format instead."),
127 ("PY004", "high", "security", r"(?i)(password|secret|api_key|token|auth_key)\s*=\s*['\"].+['\"]", "Hardcoded credential detected.", "Store secrets in environment variables, never in source code."),
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 128CWE-78
▾
126 ("PY003", "critical", "security", r"\bpickle\.loads?\s*\(", "pickle.load() can execute arbitrary code when deserialising untrusted data.", "Use json.loads() or a safe serialisation format instead."),
127 ("PY004", "high", "security", r"(?i)(password|secret|api_key|token|auth_key)\s*=\s*['\"].+['\"]", "Hardcoded credential detected.", "Store secrets in environment variables, never in source code."),
128 ("PY005", "high", "security", r"shell\s*=\s*True", "shell=True in subprocess is a command-injection risk.", "Pass a list of arguments instead: subprocess.run(['cmd', 'arg'])"),← spawns a subprocess outside declared capabilities
129 ("PY006", "high", "security", r"\.execute\s*\(.*(%|\.format\(|f['\"])", "Potential SQL injection via string formatting in execute().", "Use parameterised queries: cursor.execute(sql, (param,))"),
130 ("PY007", "medium", "bug", r"def\s+\w+\s*\([^)]*=\s*\[\s*\]", "Mutable default argument [] — shared across all calls.", "Use None as default and initialise inside the function."),
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
View latest scan →
skillox.io/c/argus1