Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent human-review workflow, but its local queue handling can write or expose decision files more broadly than users are told.
Review before installing. Do not send secrets, credentials, personal data, regulated data, or sensitive internal plans through this skill. Use it only on a trusted single-user machine or after fixing path validation, YAML/Markdown serialization, exact plan matching, ownership checks, and restrictive file permissions.
src/push.ts:110Path Traversal Through Attacker-Controlled Agent Identifier
src/push.ts:39YAML Frontmatter and Markdown Structure Injection
src/utils.ts:52Partial Plan-ID Matching Can Return the Wrong Plan and Disclose Answers
src/utils.ts:28Queue Directories and Decision Files Are Created Without Explicit Restrictive Permissions
package.json:17Dependency Resolution Is Not Reproducibly Locked
The description says this skill submits decisions to Arbiter Zebu for async human review. However, the provided code chunk is for a separate 'get' operation and does not submit anything. In fact, it does not perform retrieval either; it is only a placeholder that prints a not-implemented message and exits. This is a material mismatch in primary purpose and capability.
The description claims the skill pushes decisions to Arbiter Zebu for async human review. However, the actual code does not perform any submission, file creation, queue interaction, or review-routing behavior. It only prints a 'not yet implemented' message and exits with an error. This is a material mismatch in primary behavior, even though the comments describe an intended future implementation.
The description says the skill submits or pushes decisions to Arbiter Zebu for async human review. The actual code chunk does not do that. It is a stub for a different function: checking the status of a plan/decision file, and even that functionality is not implemented. Its primary purpose and behavior therefore differ materially from the declared description.
The declared description says this skill is for pushing decisions to Arbiter Zebu for async human review. However, the provided code implements a get command that looks up an existing plan file, checks whether its status is completed, parses decisions, and returns collected answers as JSON. Its primary purpose is result retrieval, not submission for human review. This is a material purpose mismatch, even though both relate to the same broader Arbiter workflow.
This is a material description-behavior mismatch. The declared purpose suggests an action-oriented submission skill that sends decisions to Arbiter Zebu for async human review. The supplied code does something different: it is a read-only status inspection utility for previously created plans. It locates a plan file, parses stored metadata and decisions, and prints a JSON status report. There is no evidence of pushing requests, initiating human review, or requesting approval. The code’s primary purpose, resources accessed (local plan files), and invocation triggers differ from the declaration.
The README shows users passing potentially sensitive decision context into arbiter-push and explains that a human reviews answers in Telegram, but it does not clearly warn that submitted content leaves the agent boundary and is exposed to a human-operated external review channel. In an agent skill context, this omission can cause operators or upstream agents to send secrets, internal architecture details, credentials, or regulated data for review without informed consent, resulting in confidentiality and privacy leakage.
The skill explicitly relies on environment variables (CLAWDBOT_AGENT, CLAWDBOT_SESSION) and local CLI execution, but it does not declare tool scope or permissions. That can cause the agent runtime to grant broader access than users expect and obscures that the skill reads execution context from the environment.
The skill sends plan context, decision details, and notifications into local queue files for later human review, but the description does not clearly warn users that potentially sensitive content will be persisted on disk and exposed to a human operator. In agent workflows, this can lead to inadvertent disclosure of secrets, private data, or internal plans.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
#!/usr/bin/env bash
#
# arbiter push - Create a decision file in the queue
#
# Usage: push.sh <tag> <title> [options]
#
The heartbeat guidance tells the agent to delete notification files after processing without warning that deletion is destructive and may remove evidence needed for audit, troubleshooting, or recovery. In multi-agent or asynchronous systems, premature deletion can also cause missed notifications or state inconsistencies.
The dependency gray-matter is specified with a caret range, which permits automatic installation of newer minor/patch releases than the one reviewed by the author. This weakens build reproducibility and increases supply-chain risk because a later compromised or breaking release could be pulled in without an explicit manifest change.
"get": "node dist/get.js"
},
"dependencies": {
"gray-matter": "^4.0.3",
"nanoid": "^5.0.4"
},
"devDependencies": {
The nanoid dependency is unpinned via a caret range, so consumers may resolve different releases over time. In a security-relevant package, this creates avoidable supply-chain and reproducibility risk, especially because advisory exposure cannot be confidently ruled out when the exact installed version is unspecified.
},
"dependencies": {
"gray-matter": "^4.0.3",
"nanoid": "^5.0.4"
},
"devDependencies": {
"typescript": "^5.3.3",
The manifest references nanoid without an exact pinned version, while the package has known advisories in some releases. Because the actual installed version cannot be verified from this manifest alone, the project may resolve to an affected release, creating uncertainty around ID-generation safety and potential denial-of-service or predictability issues depending on usage.
TypeScript is a development dependency, but leaving it unpinned still permits non-deterministic toolchain changes during builds. That can introduce build instability or, in a supply-chain compromise scenario, malicious code execution during development or CI installation.
"nanoid": "^5.0.4"
},
"devDependencies": {
"typescript": "^5.3.3",
"@types/node": "^20.11.0"
},
"engines": {
The @types/node package is unpinned, allowing build-time type definitions to drift across installations. While lower risk than runtime packages, it still reduces reproducibility and can contribute to supply-chain exposure in developer and CI environments.
},
"devDependencies": {
"typescript": "^5.3.3",
"@types/node": "^20.11.0"
},
"engines": {
"node": ">=20.0.0"
No suspicious patterns detected.