DAEMON Club

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:21 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed CLI-based identity and membership tool, but users should understand it creates a persistent local key and publishes public membership data when joining.

Install only if you are comfortable with a globally installed npm CLI creating a persistent local Ed25519 identity and publishing public membership claims, public keys, signatures, and related identity metadata to the DAEMON Club API and registry. Prefer reviewing or pinning the npm package version before installation if supply-chain control matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Global Installation of an Externally Maintained npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–33
Vulnerability Type: Unpinned third-party executable dependency installed globally
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: daemon-club
    bins:
      - daemon

bash

npm install -g daemon-club

Technical Analysis

The skill directs users to install the latest available release of the externally maintained daemon-club npm package globally. It does not specify an exact package version, lockfile, or expected integrity hash. The package's implementation is not included in the audited project, which contains only SKILL.md; therefore, claims concerning dependency count, private-key protection, file permissions, and network behavior cannot be independently verified from the project.

Because the dependency is unpinned, the code installed by this instruction can change after the skill has been reviewed. Global npm installation also makes the package's executable available in the user's environment. Package lifecycle scripts and the installed CLI may execute with the permissions of the invoking user.

This finding identifies a supply-chain exposure rather than proof that the current published package is malicious.

Attack Path

1. An attacker compromises the npm publisher account, publishing workflow, or another component of the package distribution process.
2. The attacker publishes a malicious release under the existing daemon-club package name.
3. A user follows the skill documentation and runs npm install -g daemon-club without an exact version or integrity constraint.
4. npm retrieves and installs the attacker-controlled release. Malicious lifecycle code may run during installation, or malicious behavior may execute when the user invokes the daemon command.
5. The compromised program executes with the invoking user's privileges and may access files available to that accou ...[truncated 1069 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specific, reviewed version in both skill metadata and installation examples, such as daemon-club@X.Y.Z.
2. Record and verify the expected npm package integrity digest before installation.
3. Include reviewable source code in the project or link the package to an immutable source commit and reproducible build.
4. Prefer a project-local installation over a global installation where operationally feasible.
5. Disable npm lifecycle scripts during installation when the package does not require them, and document any scripts that must run.
6. Publish a lockfile or equivalent dependency manifest, even if the package currently claims to have no runtime dependencies.
7. Add automated tests confirming that private keys never leave the local system and that ~/.daemon/identity.json is created with restrictive permissions.
8. Document all network destinations, transmitted fields, and privacy implications for membership and governance commands.
9. Establish package signing, protected publishing credentials, multi-factor authentication, provenance attestations, and a documented release-review process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages users to run daemon join and describes a remote API and public GitHub registry, but it does not clearly warn at the point of use that joining publishes identity-related data and signed claims to external services. This can mislead users into disclosing persistent identifiers and metadata without informed consent, which is especially risky for agent environments that may auto-install or auto-run skills.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.