Muse

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:05 AM UTC
• Version: 1.3.0

Overview

This skill is coherent, but it asks users to install and authenticate a third-party CLI that can access sensitive coding history, telemetry, knowledge-base data, and autonomous-agent workflows without enough scoping or data-handling detail.

Review before installing. Use this only with repositories and team history you are authorized to expose to Tribe/Muse, confirm what telemetry and sync upload or retain, prefer a least-privilege account, avoid enabling auto or force-sync modes in sensitive workspaces, and pin or otherwise verify the @_xtribe/cli package before trusting it with authentication.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party CLI Introduces Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–11
Vulnerability Type: Unpinned third-party npm dependency
Risk Level: Medium

yaml

install:
  method: npm
  package: "@_xtribe/cli"
  postInstall: "tribe login"

Technical Analysis

The skill requires installation of the external npm package @_xtribe/cli without specifying an exact version, lockfile, or integrity hash. Consequently, installation can resolve to a package release that differs from the version originally reviewed.

The installed CLI is subsequently trusted to authenticate the user and access sensitive development information, including coding sessions, project context, knowledge documents, and imported project data. The repository contains no source code for the dependency, so its implementation, lifecycle scripts, data handling, and network behavior could not be independently audited.

This finding does not establish that the current package is malicious. The vulnerability is the mutable and unverified trust boundary created by installing an unpinned external package and then granting it access to sensitive development context.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a future release of @_xtribe/cli.
2. A user installs the skill, and npm resolves the unpinned package reference to the compromised release.
3. Malicious package code executes during installation or when the tribe command is invoked.
4. The user runs tribe login, giving the compromised CLI access to authentication material or an authenticated session.
5. The CLI is used to search sessions, synchronize knowledge, import projects, or orchestrate agents.
6. The compromised dependency can access or transmit information available through those operations and may perform actions using the authenticated user's privileges.

Impact Assessment

Successful exploitation could expose authenticatio ...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @_xtribe/cli to an exact, security-reviewed version rather than allowing mutable version resolution.
2. Supply a lockfile and verify the package with a trusted integrity hash or signed provenance before installation.
3. Review the package source, transitive dependencies, lifecycle scripts, network endpoints, and telemetry behavior for each upgrade.
4. Disable npm lifecycle scripts during installation where they are unnecessary, then invoke only explicitly reviewed setup operations.
5. Require explicit user approval before authentication, project import, knowledge synchronization, telemetry activation, or access to coding-session data.
6. Use a least-privilege account and narrowly scoped credentials for the CLI.
7. Document what data leaves the local environment, where it is transmitted, how it is retained, and how users can revoke credentials and delete synchronized data.
8. Execute the CLI in a restricted environment with limited filesystem and network access when feasible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The metadata description emphasizes access to the team's entire coding history, past sessions, and team knowledge, but it does not include any privacy, consent, retention, or sensitivity warning. Because the skill is expressly designed to surface historical and collaborative data, omission of data-handling guardrails materially increases the risk of exposing proprietary code, credentials accidentally recorded in history, or internal discussions to inappropriate contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description advertises broad access to a team's entire coding history and project context without defining clear trigger boundaries or limits on when the skill should be used. In an agent setting, this can cause over-invocation and unnecessary exposure of sensitive historical data to workflows that do not actually require it, increasing the chance of privacy leakage or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The telemetry section provides commands to check, enable, and disable collection status, but it does not explain what is collected, where it is sent, or the privacy implications of enabling telemetry. This is risky in a tool centered on coding-session analytics, because users may activate collection without understanding that sensitive source code, prompts, commands, or metadata could be transmitted or retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The MUSE and CIRCUIT sections describe spawning, prompting, reviewing, auto-running, and monitoring autonomous agents, but they omit warnings that these workflows may take impactful actions or process sensitive project data at scale. In context, the danger is heightened because these agent features are paired with access to historical team knowledge, making unintended broad actions or disclosures more consequential.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.