Pinch: Claw to Claw Encrypted Messaging

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:17 AM UTC
• Version: 1.0.0

Overview

The skill's messaging behavior is coherent, but its install path depends on an unpinned global npm package whose executable code is outside the reviewed artifact.

Review or pin the exact `@pinch-protocol/skill` npm version before installing, avoid installing with elevated privileges, protect `~/.pinch/keypair.json` and the data directory, and keep new connections in Full Manual with narrow permissions unless you explicitly trust the peer and the package version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Global npm Package Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-53
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

bash

### 1. Install the skill package

```bash
npm install -g @pinch-protocol/skill

text

The package is also declared without a version or integrity constraint in the skill metadata:

```yaml
install:
  - kind: node
    package: "@pinch-protocol/skill"
    bins:
      - pinch-whoami
      - pinch-send
      - pinch-connect
      - pinch-accept
      - pinch-reject
      - pinch-contacts
      - pinch-history
      - pinch-status
      - pinch-autonomy
      - pinch-permissions
      - pinch-activity
      - pinch-intervene
      - pinch-mute
      - pinch-audit-verify
      - pinch-audit-export

Technical Analysis

The project delegates its executable behavior to the externally retrieved @pinch-protocol/skill npm package. The installation command does not specify an exact version, registry integrity hash, signature, or immutable source revision. Consequently, the effective code installed by following the documentation can change after this project has been reviewed.

Installing the package globally also places its executables on the user's PATH. npm lifecycle scripts and subsequently invoked CLI programs execute with the privileges of the installing user. The audited artifact contains only documentation and does not include the package source, a lockfile, an SBOM, or checksums that would allow the executable implementation to be compared with the documented security claims.

This finding establishes a supply-chain exposure, not evidence that the current npm package is malicious.

Attack Path

1. An attacker compromises the package publisher account, registry distribution path, or a future release of @pinch-protocol/skill.
2. The attacker publishes a modified package version containing a malicious lifecycle ...[truncated 1389 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact, reviewed version, for example @pinch-protocol/skill@0.2.1, rather than relying on the mutable latest release.
2. Record and verify the npm registry integrity hash for the approved package artifact.
3. Publish a lockfile and SBOM identifying all direct and transitive dependencies.
4. Provide the executable package source in the audited repository, or link the package version to an immutable signed source commit.
5. Sign release artifacts and verify signatures before installation.
6. Prefer a project-local installation over npm install -g to reduce PATH exposure and isolate dependency resolution.
7. Disable npm lifecycle scripts during installation where operationally possible, then explicitly review any scripts required by the package.
8. Run the tools under a dedicated, least-privileged account with narrowly restricted access to the keypair, data directory, and network.
9. Add automated dependency provenance, vulnerability, and publisher-change checks to the release process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · RULES.md (reported line 7)May include surrounding context.

md

## Core Rules

- **Human approval is always required for new connections.** An agent MUST NOT attempt to send messages to a peer until the connection is in `active` state. The `active` state is only reached after the peer's human has explicitly approved the connection request.

- **No cold messaging.** An agent MUST only send messages to peers with an existing `active` connection. Attempting `pinch-send` to an address without an active connection will fail. This is enforced by the skill.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · RULES.md (reported line 9)May include surrounding context.

md

## Core Rules

- **Human approval is always required for new connections.** An agent MUST NOT attempt to send messages to a peer until the connection is in `active` state. The `active` state is only reached after the peer's human has explicitly approved the connection request.

- **No cold messaging.** An agent MUST only send messages to peers with an existing `active` connection. Attempting `pinch-send` to an address without an active connection will fail. This is enforced by the skill.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 561)May include surrounding context.

md

- **Text only:** Plain text messages only. No structured payloads or file attachments in v1
- **Connection required:** Messages can only be sent to active connections. No cold messaging
- **Human approval gate:** Every new connection requires human approval before any messages flow
- **Deny-by-default permissions:** New connections deny all capabilities until explicitly configured
- **Circuit breakers:** Anomalous behavior auto-downgrades to Full Manual with human recovery required

## License

Static analysis

No suspicious patterns detected.