Add SKILL-020 through SKILL-024 checks (204 total)#59
Conversation
Move 5 skill security checks from OpenA2A CLI to HMA as the canonical scanner location: - SKILL-020: Missing/invalid YAML frontmatter validation - SKILL-021: Overprivileged permissions (dangerous capability combos) - SKILL-022: Environment variable exfiltration risk detection - SKILL-023: Obfuscated code patterns (eval, atob, hex-encoded strings) - SKILL-024: Unbounded tool chaining without iteration limits Updates check count from 199 to 204 in README.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
VERDICT: APPROVE
SUMMARY: This PR adds 5 new skill security checks (SKILL-020 through SKILL-024) to the HMA scanner, bringing the total from 199 to 204 checks. The changes are limited to README.md (documentation updates) and src/hardening/scanner.ts (new check implementations). All new checks operate on skill file content using read-only regex/string operations without external I/O. No command injection, path traversal, or other critical security vulnerabilities were introduced. The code is defensive: regex patterns use simple, linear-time quantifiers; capability matching uses explicit comparisons without shell interpolation; and all findings are informational (no automatic execution of fixes).
FINDINGS:
(none)
Reviewed 2 files changed (13191 bytes)
1 participant
Summary
Move 5 skill security checks from CLI-only to HMA scanner. These were previously only available via
opena2aCLI but not vianpx hackmyagent.New checks (199 -> 204)
Changes
src/hardening/scanner.ts: 5 new checks incheckOpenclawSkillsmethodREADME.md: Check count updated from 199 to 204Build
TypeScript compilation passes. All 5 check IDs confirmed in built output.