pharaoh

• Outcome: Review
• Latest audit: Nov 5, 2026 · 3:29 AM UTC
• Version: 0.3.6

Overview

Review is warranted because the unpinned installer’s publisher documents persistent changes to other coding agents and permissions that this skill does not explain.

Before installing, review and pin the exact npm release, including its changes to other coding agents and tool approvals. Limit GitHub access to intended repositories and accept that their source is cloned remotely for analysis. Back up customized Pharaoh skills and check uninstall wildcard matches. This review covered the bundled instructions and publisher documentation, not the downloaded executable or remote service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied chunk performs local teardown rather than codebase analysis or knowledge-graph queries. Although these operations concern the same product, uninstalling skills, changing MCP registration, and clearing credentials are materially different state-changing capabilities not disclosed in the declared purpose. Configuration edits and direct credential-file deletion appear only as comments, not executable commands.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: "Codebase knowledge graph with 8 development workflow skills. Query architecture, dependencies, blast radius and dead code via MCP. Requires GitHub App installation (read-only repo access) and OAuth authentication. Connects to external MCP server at mcp.pharaoh.so."
version: 0.3.6
homepage: https://pharaoh.so
metadata: {"openclaw": {"requires": {"bins": ["npx", "node"], "env": [], "config": "~/.pharaoh/credentials.json"}, "permissions": {"network": ["mcp.pharaoh.so", "github.com"], "filesystem": ["~/.pharaoh/", "~/.openclaw/"]}, "always": false}, "tags": ["code-intelligence", "architecture", "mcp", "knowledge-graph", "dependencies", "blast-radius", "dead-code", "code-review", "refactoring", "codebase-understanding", "developer-tools", "ai-coding"]}
---

# Pharaoh — Codebase Knowledge Graph + Developer Skill Library

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

Authentication happens separately when the MCP server first runs (not during `--install-skills`):
- **Device flow** ([RFC 8628](https://datatracker.ietf.org/doc/html/rfc8628)) — displays a code, you authorize on any device with a browser
- **Credentials stored** at `~/.pharaoh/credentials.json` (file permissions `0600`, owner-only)

No background processes are installed. No cron jobs. No system services.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

**No write access to code.** Checks is the App's only write permission. It cannot modify code, create branches, open PRs, or change settings.

**Credential storage:** `~/.pharaoh/credentials.json` — OAuth access token + refresh token. Tokens expire after 7 days with automatic refresh. Clear with `npx @pharaoh-so/mcp --logout`.

## Data & Privacy

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

**No write access to code.** Checks is the App's only write permission. It cannot modify code, create branches, open PRs, or change settings.

**Credential storage:** `~/.pharaoh/credentials.json` — OAuth access token + refresh token. Tokens expire after 7 days with automatic refresh. Clear with `npx @pharaoh-so/mcp --logout`.

## Data & Privacy

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

bash

# Remove skills (installed by --install-skills)
rm -rf ~/.openclaw/skills/pharaoh*
# Remove MCP server entry from ~/.openclaw/openclaw.json (delete the "pharaoh" key under mcpServers)

# If using Claude Code directly (without OpenClaw):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

bash

# Remove skills (installed by --install-skills)
rm -rf ~/.openclaw/skills/pharaoh*
# Remove MCP server entry from ~/.openclaw/openclaw.json (delete the "pharaoh" key under mcpServers)

# If using Claude Code directly (without OpenClaw):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Remove stored credentials

npx @pharaoh-so/mcp --logout

or: rm ~/.pharaoh/credentials.json

text

## Links

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Remove stored credentials

npx @pharaoh-so/mcp --logout

or: rm ~/.pharaoh/credentials.json

text

## Links

MCP server referenced without pinned version: 'npx @pharaoh-so/mcp'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The installation command executes an npm package without specifying a version, allowing the executed release to change without review. A compromised future release could execute code with the user's permissions and modify agent configuration or access local secrets; the skill's own version does not pin this dependency.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @pharaoh-so/mcp'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The logout command can download and execute an unpinned npm release rather than merely deleting a local credential. A compromised release could access the very tokens the user intends to remove, making this supply-chain exposure relevant even during cleanup.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @pharaoh-so/mcp'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The setup instructions repeat the unpinned npm execution command, exposing users to whichever release resolves when installation occurs. Because installation writes skills and MCP configuration, a compromised package could introduce persistent malicious agent instructions or server configuration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @pharaoh-so/mcp'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The uninstall procedure executes an unpinned npm package to log out, potentially introducing new code execution while removing the integration. If the resolved release is compromised, it could steal remaining credentials or modify local files.

Content

No source excerpt is available for this finding.