plus-ultra

• Outcome: Review
• Latest audit: Sep 5, 2026 · 4:26 PM UTC
• Version: 1.0.0

Overview

The skill is mostly transparent about its workflow gate, but its optional Claude Code setup installs broad persistent hooks that run a PATH-resolved command across sessions.

Install only if you intentionally want a persistent Claude Code workflow gate. Prefer pinning the installer and repository version, use an absolute path for the hook command instead of relying on PATH, review the hook settings before merging them, and avoid putting secrets in recorded verdict text.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:68
• Finding: Unpinned Remote Installation Command Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `README.md:68` **Vulnerability Type**: Unpinned third-party installer and mutable repository reference **Risk Level**: Medium ### Vulnerable Code ```sh npx skills add AntreasAntoniou/plus-ultra ``` ### Technical Analysis The documented installation procedure uses `npx` without specifying a fixed version of the `skills` package. It also identifies the Skill repository by a mutable owner/repository reference rather than a reviewed commit SHA or immutable release artifact. Consequently, the code and installation behavior obtained when a user runs this command may differ from the content audited in this repository. A compromise of the npm package, its publisher account, or the upstream repository could cause later installations to retrieve or install attacker-controlled content. The repository itself does not contain code that automatically invokes this command, so exploitation requires a user to follow the documented installation procedure. ### Attack Path 1. An attacker compromises the npm package, package publisher account, or referenced upstream repository. 2. The attacker publishes a malicious package version or modifies the repository content reached through the mutable reference. 3. A user follows the README and runs the unpinned `npx skills add AntreasAntoniou/plus-ultra` command. 4. `npx` retrieves the currently published package rather than a previously audited version. 5. The compromised installer or repository content is installed or executed with the invoking user's privileges. ### Impact Assessment Successful exploitation could execute installation logic or install modified Skill content with the privileges of the user running `npx`. The resulting scope can include files, credentials, agent configuration, and repositories accessible to that user. This command does not request elevated operating-system privileges by itself, so its direct privilege scope is normal ...[truncated 35 chars]
• Remediation: ## Remediation Suggestions - Pin the `skills` CLI to a reviewed version, such as `npx skills@<exact-version>`. - Pin the Skill repository to an immutable commit SHA or cryptographically signed release. - Publish expected checksums or signatures for release artifacts and document how users should verify them. - Provide a manual installation procedure that does not execute a remotely retrieved package. - Recommend reviewing the downloaded files before enabling hooks. - Use dependency lock files and automated supply-chain monitoring where an installer package is maintained.

T07 · Tool Hijacking and Spoofing

Error

• Location: examples/claude-settings.json:6
• Finding: Persistent Hooks Resolve the Executable Through PATH## Vulnerability Details **File Location**: `examples/claude-settings.json:6-18` **Vulnerability Type**: Executable search-path hijacking in persistent hook configuration **Risk Level**: High ### Vulnerable Code ```json "UserPromptSubmit": [ { "matcher": "*", "hooks": [{"type": "command", "command": "plusultra hook"}] } ], "PreToolUse": [ { "matcher": "*", "hooks": [{"type": "command", "command": "plusultra hook"}] } ], "Stop": [ { "matcher": "*", "hooks": [{"type": "command", "command": "plusultra hook"}] } ] ``` ### Technical Analysis All three persistent Claude Code hooks invoke `plusultra` using a bare executable name. The operating system therefore resolves the program through the effective `PATH` each time a hook runs. If an attacker can place or replace an executable named `plusultra` in a directory searched before the legitimate installation directory, Claude Code will execute the attacker-controlled program. The broad `matcher` values cause invocation on every configured prompt submission, tool use, and stop event. Persistent hook registration is an explicit and necessary part of the declared enforcement feature and is not itself covert persistence. The vulnerability is that the persisted configuration does not bind execution to a specific, verified program. ### Attack Path 1. The user merges the example hooks into the persistent Claude Code settings. 2. An attacker gains write access to a directory that appears earlier in the effective `PATH`, or modifies the user's environment so such a directory is searched first. 3. The attacker places a malicious executable named `plusultra` in that directory. 4. The user starts or continues a Claude Code session. 5. A configured `UserPromptSubmit`, `PreToolUse`, or `Stop` event occurs. 6. Command resolution selects the attacker's executable. 7. The malicious process executes with the user's privilege ...[truncated 687 chars]
• Remediation: ## Remediation Suggestions - Replace the bare command with an absolute path to the reviewed script or executable. - Install the executable and its parent directory in locations writable only by the owning user or an administrator. - Avoid user-writable or project-controlled directories in the hook execution `PATH`. - Extend `plusultra doctor` to report the resolved executable path and verify file ownership and permissions. - Optionally verify the installed executable against a published cryptographic hash or signature. - Document complete hook removal and executable cleanup procedures. - Test the hooks in a disposable session after installation and after upgrades.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/plusultra.py:125
• Finding: Persisted Plan and Verification Records Lack Explicit Restrictive Permissions## Vulnerability Details **File Location**: `scripts/plusultra.py:125-141` **Vulnerability Type**: Potential local disclosure of plaintext workflow state **Risk Level**: Low ### Vulnerable Code ```python def _ensure(): os.makedirs(STATE, exist_ok=True) def _path(session): return os.path.join(STATE, session + ".json") def save(session, data): if not _valid_session(session): return False # and can never mint one either _ensure() p = _path(session) tmp = p + ".tmp" with open(tmp, "w", encoding="utf-8") as fh: json.dump(data, fh) os.replace(tmp, p) # atomic — a half-written gate state fails open, which is wrong return True ``` Related verdict data is stored in this state by the plan and confirmation commands: ```python st["plan"] = {"arbiter": _flag(args, "--arbiter", "Athena"), "at": _now(), "entry": _required_verdict(args, "plan")} ``` ```python st["reality"] = {"verifier": _flag(args, "--verifier", "Argus"), "at": _now(), "entry": _required_verdict(args, "reality"), "for_mutations": mutations} ``` ### Technical Analysis The state directory is created without an explicit `0700` mode, and temporary state files are opened without explicitly requesting a restrictive `0600` mode. The final file inherits the temporary file's permissions after `os.replace`. Actual permissions therefore depend on the process umask and any pre-existing directory permissions. On systems with a permissive umask or an existing overly permissive `~/.plus-ultra` hierarchy, other local users may be able to read stored plan and verification text. The stored data is not automatically sourced from credentials, and the project does not intentionally collect secrets. However, verdict text can include file paths, architecture details, operational procedures, repository information, or other sensitive task context. T ...[truncated 1180 chars]
• Remediation: ## Remediation Suggestions - Create `~/.plus-ultra` and its state directory with mode `0700`. - Create state and audit files with mode `0600`, using `os.open` with explicit flags and modes where necessary. - Validate and repair permissions on pre-existing directories and files before use. - Reject symbolic links and verify that state paths remain beneath the intended root. - Preserve atomic replacement while ensuring the temporary file has owner-only permissions. - Document that verdicts and audit details must not contain passwords, access tokens, private keys, or other secrets. - Add tests that assert restrictive permissions on supported POSIX systems.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises operational behavior involving shell commands, environment variables, and file reads/writes, but it declares no permissions or equivalent capability boundaries. That mismatch can cause hosts or reviewers to underestimate what the skill may access or execute, increasing the chance of unintended command execution or sensitive data exposure when the skill is invoked.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The invocation text uses broad triggers such as 'maximum rigor' and 'help responding to a Plus Ultra hook gate,' which can match ordinary user requests and cause the skill to activate more often than intended. Over-broad activation is risky here because the skill introduces shell-based workflow steps and stateful enforcement concepts, potentially changing agent behavior in contexts where the user did not explicitly request it.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: All three hook points use a wildcard matcher, causing the `plusultra hook` command to run for every prompt, every tool invocation, and every stop event without scope restriction. This broad activation increases the chance of unintended interference, recursive behavior, denial-of-service style slowdowns, and execution in contexts where the skill was not explicitly requested, which is especially relevant because the skill is designed to insert itself into consequential workflows.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_plusultra.py:13