ClawHub
Back to skill

Security audit

Ai Compound 1.0.1

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent memory-automation purpose, but it asks to run unpinned code, schedule recurring background reviews, and commit or push session-derived memory without enough safeguards.

Install only if you are comfortable with an agent scanning recent sessions, writing long-term memory and instruction files, and potentially committing or pushing those changes. Pin and verify the npm package before running it, avoid automatic cron or LaunchAgent setup until you have reviewed the exact job, keep memory files out of public repositories unless sanitized, and require manual review before changes to AGENTS.md, MEMORY.md, or any git push.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:107
Finding

Persistent Agent Memory Poisoning Through Untrusted Session Summaries

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:202
Finding

Cross-Session Persistence Through Cron and macOS LaunchAgent Registration

Content
View full analysis
Label com.clawdbot.compound-review ProgramArguments /opt/homebrew/bin/clawdbot cron run compound-nightly StartCalendarInterval Hour 22 Minute 30 ``` ```bash # Add with: crontab -e 0 * * * * /opt/homebrew/bin/clawdbot cron run compound-hourly 2>&1 >> ~/clawd/logs/compound.log ``` ### Technical Analysis The Skill recommends installing either a user LaunchAgent or a crontab entry. Both mechanisms survive the initiating session and repeatedly invoke Clawdbot without interactive authorization. Scheduling is related to the declared automatic-review functionality, but it is not necessary for manual review and materially expands the Skill's privileges. The persistent job repeatedly accesses session history and modifies long-term memory. The documentation does not define an expiration time, uninstall procedure, runtime approval check, integrity verification, or privilege boundary. The persistence mechanism compounds the memory-poisoning risk: malicious content can be processed automatically even when the user is not present to inspect the resulting changes. ### Attack Path 1. A user follows the setup instructions and registers the LaunchAgent or cron entry. 2. The scheduled task remains active after the original Skill invocation ends. 3. At each scheduled interval, Clawdbot processes sessions and writes memory files ...[truncated 884 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:19
Finding

Execution of an Unpinned npm Package Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:36
Finding

Potential Disclosure of Session-Derived Sensitive Data Through Automated Git Operations

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prominently advertises automatic updates to memory files and commits/pushes changes, but it does not clearly warn users that local files and repositories may be modified automatically. In context, this can cause unintended data alteration, accidental publication of sensitive notes, or repository pollution because the automation is framed as routine improvement rather than a potentially risky write-and-sync operation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to execute npx compound-engineering without pinning a package version, which can cause whatever package is latest on the registry at runtime to be fetched and executed. In a skill whose purpose is to automate recurring jobs, this increases supply-chain risk because a compromised or malicious future release could be repeatedly invoked by users or schedulers.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This command uses npx compound-engineering without a pinned version, so the executed code may differ over time and may include an attacker-controlled update if the package or dependency chain is compromised. Because the command creates snapshots that may run on a schedule, the blast radius includes repeated execution of unreviewed code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The setup command again relies on an unpinned npx package, which is especially risky because it configures persistence and automation on the host. If a later package version is malicious, it could alter cron or launch agents and establish durable execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill directs the agent to extract and store user preferences from prior sessions without a privacy notice or limits on what types of preferences may be retained. This is dangerous because preferences often include behavioral, identity, scheduling, or operational details that can become sensitive once persisted and later surfaced or committed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented memory workflow stores user preferences and project context in persistent files, creating a durable natural-language record that may include confidential business or personal information. Because the skill also recommends version control, the retained data can spread across commit history and remotes, making accidental disclosure harder to remediate.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manual review instructions tell the agent to summarize learned preferences, decisions, and open items into long-term memory files and then commit them, which can capture sensitive project state, strategy, or personal information in durable storage. This materially increases leakage risk because natural-language summaries often bypass traditional secret scanning and become embedded in git history.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md
- User prefers Z approach for...

## Gotchas to Avoid  
- Don't do X without checking Y
- API Z has rate limit of...

## User Preferences

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example memory structure explicitly stores user preferences, timezone, and project context such as repository paths and deployment details in long-term memory. In context, these are exactly the kinds of details that can aid social engineering, reveal internal infrastructure, or expose private user information over time.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The launchd plist example instructs the user to install a persistent scheduled job. While not inherently malicious, persistence on a user machine is security-relevant and should be treated carefully, especially since the job will invoke automation that reviews sessions and updates files regularly.

Content

Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.

Nightly Review (launchd - macOS)

xml
<!-- ~/Library/LaunchAgents/com.clawdbot.compound-review.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

xml
<!-- ~/Library/LaunchAgents/com.clawdbot.compound-review.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

xml
<!-- ~/Library/LaunchAgents/com.clawdbot.compound-review.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

xml
<!-- ~/Library/LaunchAgents/com.clawdbot.compound-review.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

xml
<!-- ~/Library/LaunchAgents/com.clawdbot.compound-review.plist -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>Label</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The skill provides crontab instructions that establish recurring execution on the host, which is a persistence mechanism. In this skill's context persistence is a stated feature rather than covert malware behavior, but it still creates security risk because scheduled tasks can repeatedly process sensitive data and continue running after the user forgets they were installed.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

Hourly Memory (crontab)

bash
# Add with: crontab -e
0 * * * * /opt/homebrew/bin/clawdbot cron run compound-hourly 2>&1 >> ~/clawd/logs/compound.log

Static analysis

No suspicious patterns detected.