AGENTIC AI GOLD STANDARD

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:42 AM UTC
• Version: 4.0.0

Overview

This skill is mostly promotional demos, but it advertises production autonomous security features and uses an unsafe installer, so users should review it carefully before installing.

Install only in an isolated environment after reviewing the installer. Do not rely on the claimed security gates, self-improvement, persistence, memory, fallback, or MCP/A2A capabilities unless the publisher provides real implementation code, pinned dependencies, failing verification tests, clear data-flow documentation, and explicit controls for persistent behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: install.sh:21

Finding

Unpinned Third-Party Dependencies Execute Mutable Supply-Chain Code

Content

View full analysis

/dev/null || true ``` Related documentation also recommends executing a mutable npm release: ```bash npx clawhub@latest install agentic-ai-gold ``` This instruction appears in `skill.md:29-31` and `QUICKSTART.md:5-7`. A similar command using a different package identifier appears in `README.md:34-36`. ### Technical Analysis The installer downloads and installs six Python packages without exact version constraints or integrity hashes. Consequently, the installed code is determined by the package registry at installation time rather than by the reviewed project contents. Python package installation can execute package build hooks and other package-controlled code with the privileges of the user running the installer. The documented `npx ...@latest` commands similarly request a mutable npm release whose contents may change after this audit. The command also redirects standard error to `/dev/null` and uses `|| true`. This masks dependency resolution errors, integrity problems, package build failures, and partial installation. The installer can therefore continue and report success even when its dependency installation failed or produced an inconsistent environment. No evidence establishes that the named dependencies are currently malicious. The vulnerability is the unbounded and mutable supply-chain trust introduced by the installation process. ### Attack Path 1. An attacker compromises one of the referenced package releases, its maintainer account, its distribution infrastructure, or a mutable `latest` release. 2. A user follows the installation instructions or runs `install.sh`. 3. `pip` or `npx` download ...[truncated 724 chars]

Remediation

View remediation

/dev/null || true`; installation must fail visibly when a dependency cannot be securely installed. 7. Perform installation in an isolated virtual environment rather than modifying the user's general Python environment. 8. Add automated dependency vulnerability, provenance, and package-name verification. 9. Document the expected versions and verify them after installation. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: install.sh:25

Finding

Environment-Controlled Path Is Interpolated into Executable Python Source

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: install.sh:30

Finding

Installation Verification Reports Security Controls Without Testing Them

Content

View full analysis

0.1 # 90% pass rate status = "✅ PASS" if success else "❌ FAIL" ``` This is security-relevant because users are explicitly told that containment, consent, rev ...[truncated 1463 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a sophisticated self-improving AI infrastructure with security gates, resilience tiers, and substantial research grounding. The supplied code chunk is only an illustrative example script with simulated behavior. It does not implement actual self-improvement, enforce any security gates, provide resilience mechanisms, access models, manage memory beyond basic Python objects, or use any research corpus. Its primary purpose is a hello-world style demonstration that prints a mocked system activation/status flow. This is a material mismatch between the ambitious declared purpose and the code's actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad, production-like self-improving AI framework with substantial security, resilience, and research-backed capabilities. The supplied code chunk is only an example script demonstrating dynamic creation of simulated specialist agents. Its behavior is largely illustrative: it prints messages, instantiates simple Python objects, simulates five named security checks despite claiming 17, and returns predefined strings describing fake work. There is no evidence of self-improvement, infrastructure orchestration, resilience mechanisms, research ingestion, or real security enforcement. Therefore the description materially overstates and misrepresents what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description materially overstates what the code does. The supplied chunk is an example script that demonstrates a mocked 'self-improvement engine' through console output and randomized values. Its primary purpose is illustrative, not operational. It does not connect to research sources, analyze real documents, modify itself, run real integration tests, or implement the broad infrastructure/security features claimed in the description. This is a clear description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared description presents a substantive agent framework with self-improvement, security controls, resilience mechanisms, and advanced infrastructure. The supplied code chunk does not implement any of these features; it only prints static text that claims they are active. There is no real agent logic, no security gating, no fallback handling, no memory system, and no self-improvement behavior. The primary purpose of the code chunk is demonstrative/promotional output rather than actual framework functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a sophisticated self-improving AI framework with concrete security and resilience capabilities. The supplied code chunk does not implement those capabilities; it merely performs environment setup: verifies Python >=3.10, installs dependencies via pip, creates directories, and prints success messages. The 'verification' step does not actually test framework features—it just prints claims inside a try block. Therefore the description materially overstates what this code does, and the primary purpose of the chunk is installation/setup rather than delivering the advertised functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code and surrounding text present the feature as operational and 'not metaphorical' even though the implementation is explicitly simulated. This is dangerous because it can create false assurance about autonomous research, validation, and governance capabilities in an agentic system, increasing the chance that users rely on nonexistent safeguards or functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes nightly scanning, testing, proposing updates, and evolving itself, while emphasizing that this is 'operational,' but it does not provide a prominent safety warning about automated self-modification. In a self-improving agent context, unreviewed overnight changes can introduce prompt drift, insecure configurations, new tool permissions, or malicious code paths, substantially increasing risk beyond a normal static skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The quickstart instructs users to run npx clawhub@latest install agentic-ai-gold, which fetches and executes the latest published package version at install time rather than a reviewed, pinned version. This creates a supply-chain risk: if the package or its dependency chain is compromised, or if a breaking/malicious release is published later, users following the documentation may execute untrusted code on their systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly markets the system as 'living infrastructure' that 'rewrites itself' based on ongoing research, but it does not clearly warn users that the software may modify code or system behavior autonomously. In an agent framework context, undisclosed self-modifying or self-updating behavior can lead to unauthorized changes, unsafe automation, and reduced operator control over production environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute npx clawhub@latest install agentic-ai, which pulls and runs the latest published package without pinning a specific version or integrity hash. This creates a supply-chain risk: if the package is compromised or a malicious update is published, users may execute attacker-controlled code directly from the installation command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises native MCP and A2A support with access to '10,000+ production servers' and broad external connectivity, but it does not include a corresponding privacy, credential-scope, or data-transmission warning. In an agentic system, this omission increases the risk that users expose sensitive data or grant overly broad external access without understanding where agent prompts, memory, or tool outputs may be sent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file advertises a self-improving capability, but the implementation is only a simulation driven by print statements and random values. In a security-sensitive agent framework, this mismatch can mislead operators into believing research, testing, and validation controls are actually running, which creates unsafe trust assumptions and can cause unreviewed deployment decisions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 25)May include surrounding context.

sh

echo "📦 Installing dependencies..."
pip install -q langgraph openai-agents crewai pydantic-ai mem0 zep-python 2>/dev/null || true

# Create config directory
mkdir -p ~/.agentic_ai/config

# Copy skill files

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script presents a verification phase that appears to validate the framework, but it only prints reassuring status messages inside a try block and performs no real checks. This can mislead users into believing the installation and security features are functioning when dependencies, modules, or protections may be absent or broken.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command uses npx clawhub@latest, which fetches and executes the most recent package version without pinning or integrity verification. In a skill explicitly encouraging installation and activation of an autonomous, self-improving framework, this creates a supply-chain risk where a compromised or malicious upstream release could be executed immediately on the user's system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill promotes a '24/7 Persistent Council' and states it runs continuously for low cost, but it does not present a clear, front-loaded warning about ongoing autonomous behavior, resource consumption, and external actions. In context, this increases the chance that users enable a continuously running agent system without understanding that it may keep making calls, spending money, retaining data, or interacting with tools after initial setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code installs Python packages with pip and creates directories under the user's home directory, which are safety-relevant side effects for an installation script. While there are progress messages, the script does not clearly disclose that it will modify the Python environment and write to ~/.agentic_ai/config and the skill directory before doing so.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.