Security audit

Ai Compound 1.0.1

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent memory-automation purpose, but it asks to run unpinned code, schedule recurring background reviews, and commit or push session-derived memory without enough safeguards.

Install only if you are comfortable with an agent scanning recent sessions, writing long-term memory and instruction files, and potentially committing or pushing those changes. Pin and verify the npm package before running it, avoid automatic cron or LaunchAgent setup until you have reviewed the exact job, keep memory files out of public repositories unless sanitized, and require manual review before changes to AGENTS.md, MEMORY.md, or any git push.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:107
Finding: Persistent Agent Memory Poisoning Through Untrusted Session Summaries<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 107-128 **Vulnerability Type**: Persistent modification of trusted Agent memory and instruction files **Risk Level**: High ### Vulnerable Code ```text Review the last 24 hours of work. Extract: 1. **Patterns that worked** - approaches to repeat 2. **Gotchas encountered** - things to avoid 3. **Preferences learned** - user likes/dislikes 4. **Key decisions** - and their reasoning 5. **Open items** - unfinished work Update: - MEMORY.md with significant long-term learnings - memory/YYYY-MM-DD.md with today's details - AGENTS.md if workflow changes needed Commit changes with message "compound: daily review YYYY-MM-DD" ``` ### Technical Analysis The Skill instructs the Agent to treat content from all sessions in the preceding 24 hours as a source of persistent knowledge. It then permits extracted content to be written to `MEMORY.md`, daily memory files, and `AGENTS.md`. Session content is untrusted because it may include messages from external users, copied web content, tool output, repository documentation, or deliberate prompt-injection payloads. The workflow does not require provenance validation, separation of instructions from data, prompt-injection detection, or human approval before modifying persistent state. Modification of `AGENTS.md` is especially dangerous because this file may be interpreted as authoritative workflow instructions in future sessions. An attacker-controlled statement can therefore be transformed from transient conversation content into a durable instruction. ### Attack Path 1. An attacker introduces a message into a session reviewed by the Skill. 2. The message presents a malicious instruction as a user preference, workflow improvement, recurring pattern, or operational requirement. 3. The scheduled or manual review processes the session without treating its contents as untrusted input. 4. The Agent writes the malicious rule into `MEMORY.md` or `AGENTS.md`. ...[truncated 877 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Prohibit automatic modification of `AGENTS.md`; changes to authoritative instruction files must require explicit human approval. - Treat all reviewed session content as untrusted data rather than executable instructions. - Generate a proposed diff in a separate staging file instead of directly updating persistent memory. - Require the user to inspect and approve each proposed persistent-memory change. - Reject imperative statements, tool-use directives, requests to weaken safeguards, and content attempting to redefine Agent behavior. - Preserve provenance for every proposed memory item, including the originating session and message. - Restrict persistent memory to factual summaries and explicitly structured preferences. - Apply allowlisted schemas and length limits to stored memory. - Provide rollback and audit-log mechanisms for all persistent-memory changes. ]]>

T06 · System Persistence

Error

Location: SKILL.md:202
Finding: Cross-Session Persistence Through Cron and macOS LaunchAgent Registration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 202-235 **Vulnerability Type**: Persistent scheduled execution **Risk Level**: High ### Vulnerable Code ```xml  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0" encoding="..."> <plist version="1.0"> <dict> <key>Label</key> <string>com.clawdbot.compound-review</string> <key>ProgramArguments</key> <array> <string>/opt/homebrew/bin/clawdbot</string> <string>cron</string> <string>run</string> <string>compound-nightly</string> </array> <key>StartCalendarInterval</key> <dict> <key>Hour</key> <integer>22</integer> <key>Minute</key> <integer>30</integer> </dict> </dict> </plist> ``` ```bash # Add with: crontab -e 0 * * * * /opt/homebrew/bin/clawdbot cron run compound-hourly 2>&1 >> ~/clawd/logs/compound.log ``` ### Technical Analysis The Skill recommends installing either a user LaunchAgent or a crontab entry. Both mechanisms survive the initiating session and repeatedly invoke Clawdbot without interactive authorization. Scheduling is related to the declared automatic-review functionality, but it is not necessary for manual review and materially expands the Skill's privileges. The persistent job repeatedly accesses session history and modifies long-term memory. The documentation does not define an expiration time, uninstall procedure, runtime approval check, integrity verification, or privilege boundary. The persistence mechanism compounds the memory-poisoning risk: malicious content can be processed automatically even when the user is not present to inspect the resulting changes. ### Attack Path 1. A user follows the setup instructions and registers the LaunchAgent or cron entry. 2. The scheduled task remains active after the original Skill invocation ends. 3. At each scheduled interval, Clawdbot processes sessions and writes memory files ...[truncated 884 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Default to manual execution and make all scheduling explicitly opt-in. - Display the exact task definition and its security implications before installation. - Require confirmation immediately before creating a cron entry or LaunchAgent. - Add documented disable and uninstall commands for every supported scheduler. - Configure a finite expiration time or require periodic renewal. - Run the job under a dedicated low-privilege account with access only to the required memory directory. - Require an approval step before any scheduled run changes persistent instruction files or performs Git operations. - Use absolute, integrity-verified executable paths and validate file ownership and permissions. - Record all scheduled runs and changes in an append-only audit log. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:19
Finding: Execution of an Unpinned npm Package Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-29 **Vulnerability Type**: Unsafe third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash # Review last 24 hours and update memory npx compound-engineering review # Create hourly memory snapshot npx compound-engineering snapshot # Set up automated nightly review (cron) npx compound-engineering setup-cron ``` ### Technical Analysis The commands use `npx` with a package name but no exact version or integrity constraint. If the package is not already available locally, `npx` may download the current package release from the configured npm registry and execute it immediately. The effective implementation is not present in the audited project. Consequently, the package payload can change after this Skill has been reviewed. A compromised maintainer account, malicious package release, registry configuration change, or package ownership transfer could introduce arbitrary code. The `setup-cron` command is particularly sensitive because its declared purpose includes establishing persistent scheduled execution. The documentation provides no source verification, checksum validation, lockfile, or reproducible installation procedure. ### Attack Path 1. An attacker compromises the `compound-engineering` npm package, its publisher account, or the registry resolution path. 2. The attacker publishes a malicious version under the expected package name. 3. A user follows the Skill's Quick Start instructions. 4. `npx` resolves and downloads the attacker-controlled package version. 5. Package code or installation lifecycle scripts execute with the invoking user's privileges. 6. The malicious package can read accessible files, modify Agent state, steal credentials, or abuse `setup-cron` to establish persistent execution. ### Impact Assessment The downloaded package executes with the permissions of the invoking user. This can expose local repositories, session records, API c ...[truncated 315 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Pin the package to an exact, reviewed version rather than relying on the registry's current release. - Verify package integrity with a lockfile and cryptographic integrity hashes. - Publish and link the source corresponding to the pinned package version. - Vendor the minimal reviewed implementation where practical. - Avoid executing packages directly through `npx` in security-sensitive setup instructions. - Disable npm lifecycle scripts where they are not required. - Run the package in a sandbox with restricted filesystem, network, credential, and process access. - Separate schedule generation from installation: output the proposed scheduler configuration and require the user to install it explicitly. - Re-audit package updates before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:36
Finding: Potential Disclosure of Session-Derived Sensitive Data Through Automated Git Operations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 36-46 **Vulnerability Type**: Unsafe collection and publication of sensitive session-derived data **Risk Level**: High ### Vulnerable Code ```text ┌─────────────────────────────────────────┐ │ NIGHTLY REVIEW (10:30 PM) │ │ • Scan all sessions from last 24h │ │ • Extract learnings and patterns │ │ • Update MEMORY.md and AGENTS.md │ │ • Commit and push changes │ └────────────────┬────────────────────────┘ ``` The same workflow later recommends: ```text 5. **Open items** - unfinished work Update: - MEMORY.md with significant long-term learnings - memory/YYYY-MM-DD.md with today's details - AGENTS.md if workflow changes needed Commit changes with message "compound: daily review YYYY-MM-DD" ``` ### Technical Analysis The workflow scans session history, extracts potentially sensitive operational context, stores it in version-controlled files, and instructs the Agent to commit and push the changes. Session-derived data can include user preferences, internal project paths, decisions, unfinished work, deployment information, credentials pasted into conversations, confidential source excerpts, and tool output. The Skill does not require secret scanning, data classification, redaction, repository-visibility validation, remote-destination verification, or user review before Git publication. Git history also makes accidental disclosure difficult to remediate. Deleting a secret from the latest file version does not remove it from prior commits or from remote clones. ### Attack Path 1. Sensitive information appears in a reviewed session, either accidentally or through ordinary project work. 2. The nightly review extracts the information as a preference, decision, gotcha, project detail, or open item. 3. The Agent writes the information to `MEMORY.md`, `AGENTS.md`, or a dated memory file. 4. The automated workflow commits the file. 5. The workflow ...[truncated 930 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove automatic `git push` behavior from the review workflow. - Generate a local proposed diff and require explicit user approval before committing or publishing it. - Run secret detection and sensitive-data classification before writing or committing memory files. - Redact credentials, tokens, personal data, private paths, and confidential project details. - Verify the repository remote, ownership, and visibility before any publication. - Store private Agent memory outside the repository by default and add it to `.gitignore`. - Encrypt sensitive persistent memory at rest where retention is necessary. - Minimize collection to explicitly approved fields and apply retention limits. - If sensitive data has already been committed, rotate exposed credentials and rewrite repository history rather than merely deleting the latest file content. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill prominently advertises automatic updates to memory files and commits/pushes changes, but it does not clearly warn users that local files and repositories may be modified automatically. In context, this can cause unintended data alteration, accidental publication of sensitive notes, or repository pollution because the automation is framed as routine improvement rather than a potentially risky write-and-sync operation.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs users to execute `npx compound-engineering` without pinning a package version, which can cause whatever package is latest on the registry at runtime to be fetched and executed. In a skill whose purpose is to automate recurring jobs, this increases supply-chain risk because a compromised or malicious future release could be repeatedly invoked by users or schedulers.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This command uses `npx compound-engineering` without a pinned version, so the executed code may differ over time and may include an attacker-controlled update if the package or dependency chain is compromised. Because the command creates snapshots that may run on a schedule, the blast radius includes repeated execution of unreviewed code.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The setup command again relies on an unpinned `npx` package, which is especially risky because it configures persistence and automation on the host. If a later package version is malicious, it could alter cron or launch agents and establish durable execution.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill directs the agent to extract and store user preferences from prior sessions without a privacy notice or limits on what types of preferences may be retained. This is dangerous because preferences often include behavioral, identity, scheduling, or operational details that can become sensitive once persisted and later surfaced or committed.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The documented memory workflow stores user preferences and project context in persistent files, creating a durable natural-language record that may include confidential business or personal information. Because the skill also recommends version control, the retained data can spread across commit history and remotes, making accidental disclosure harder to remediate.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The manual review instructions tell the agent to summarize learned preferences, decisions, and open items into long-term memory files and then commit them, which can capture sensitive project state, strategy, or personal information in durable storage. This materially increases leakage risk because natural-language summaries often bypass traditional secret scanning and become embedded in git history.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - User prefers Z approach for... ## Gotchas to Avoid - Don't do X without checking Y - API Z has rate limit of... ## User Preferences
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The example memory structure explicitly stores user preferences, timezone, and project context such as repository paths and deployment details in long-term memory. In context, these are exactly the kinds of details that can aid social engineering, reveal internal infrastructure, or expose private user information over time.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Nightly Review (launchd - macOS) ```xml  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0">
Confidence: 83% confidence
Finding: The launchd plist example instructs the user to install a persistent scheduled job. While not inherently malicious, persistence on a user machine is security-relevant and should be treated carefully, especially since the job will invoke automation that reviews sessions and updates files regularly.

Session Persistence

Medium

Category: Rogue Agent
Content: ```xml  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key>
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```xml  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key>
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```xml  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key>
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ```xml  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "..."> <plist version="1.0"> <dict> <key>Label</key>
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

Category: Rogue Agent
Content: ### Hourly Memory (crontab) ```bash # Add with: crontab -e 0 * * * * /opt/homebrew/bin/clawdbot cron run compound-hourly 2>&1 >> ~/clawd/logs/compound.log ```
Confidence: 87% confidence
Finding: The skill provides crontab instructions that establish recurring execution on the host, which is a persistence mechanism. In this skill's context persistence is a stated feature rather than covert malware behavior, but it still creates security risk because scheduled tasks can repeatedly process sensitive data and continue running after the user forgets they were installed.

Static analysis

No suspicious patterns detected.