https://clawhub.ai/api/v1/skills/argus-pro/file?path=SKILL.md&version=1.0.4
github.com/clawhub.ai/argus-pro
Scanned Thu, 28 May 2026 16:04:10 GMT
Scan ID crawl-xeknnn90bmaqd43sh8b71jg6 · 3ms
B
SCORE 75 / 100
Verdict: Safe to install

3 medium findings.

This skill spawns subprocesses outside its declared capabilities plus 2 other issues listed below.

0 critical0 high3 medium9 rules passed

Why grade B?

score · 75 / 100

The current grade reflects 3 medium findings (3+ MEDs → B).

0 CRIT0 HIGH3 MED0 LOW
To reach a higher grade
  • A
    Reach Atarget score 95

    Resolve 1 of 3 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 144CWE-78
▾
142 # Security
143 ("PY001","critical","security", r"\beval\s*\(", "eval() executes arbitrary code.", "Use ast.literal_eval() for safe literal evaluation."),
144 ("PY002","critical","security", r"\bexec\s*\(", "exec() executes arbitrary code.", "Refactor to eliminate dynamic code execution."),← spawns a subprocess outside declared capabilities
145 ("PY003","critical","security", r"\bpickle\.loads?\s*\(", "pickle.load() with untrusted data enables code execution.", "Use json.loads() instead."),
146 ("PY004","high","security", r"(?i)(password|secret|api_key|token|auth_key)\s*=\s*['\"].+['\"]", "Hardcoded credential.", "Use environment variables."),
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 147CWE-78
▾
145 ("PY003","critical","security", r"\bpickle\.loads?\s*\(", "pickle.load() with untrusted data enables code execution.", "Use json.loads() instead."),
146 ("PY004","high","security", r"(?i)(password|secret|api_key|token|auth_key)\s*=\s*['\"].+['\"]", "Hardcoded credential.", "Use environment variables."),
147 ("PY005","high","security", r"shell\s*=\s*True", "shell=True is a command-injection risk.", "Use list arguments: subprocess.run(['cmd','arg'])"),← spawns a subprocess outside declared capabilities
148 ("PY006","high","security", r"\.execute\s*\(.*(%|\.format\(|f['\"])", "Potential SQL injection via string formatting.", "Use parameterised queries."),
149 ("PY016","medium","security", r"hashlib\.(md5|sha1)\s*\(", "MD5/SHA1 are cryptographically weak.", "Use hashlib.sha256() or bcrypt for passwords."),
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-xeknnn90bmaqd43sh8b71jg6