Security audit
Security checks for vulnerabilities and agentic risk
This documentation-only skill does not ship executable code, but the system it points users to has broad local agent/session access and some risky setup/reset instructions that deserve careful review.
Install only if you are comfortable auditing the linked GitHub project and running a local command-center service. Before use, review what it reads from ~/.claude/projects, restrict who can access the dashboard, avoid passing API keys directly on the command line, back up .mission-control/ before reset commands, and treat agent SOUL/MEMORY/IDENTITY edits as behavior-changing operations.
The command rm .mission-control/tasks/*.json can mass-delete all task records with no safety guardrails, and users may run it directly from documentation. In a command-center product managing operational state, bulk deletion of task files can disrupt workflows and destroy audit/history data.
# Clear all tasks (keeps agent config)
rm .mission-control/tasks/*.json
# Full reset
rm -rf .mission-control/
The command rm -rf .mission-control/ recursively deletes the entire application data directory, including tasks, agents, messages, queues, and logs. Because it is presented as a simple reset step in documentation, it creates a substantial risk of catastrophic irreversible data loss if copied, modified, or run from the wrong working directory.
rm .mission-control/tasks/*.json
rm -rf .mission-control/
The file explicitly says the skill is 'instruction-only' and that 'nothing executes automatically,' but the rest of the document describes capabilities involving session discovery, polling, command execution, file editing, syncing, and automatic task creation. This is dangerous because it can cause users to underestimate the operational and privacy impact of the referenced system, leading them to install or run it without informed consent or adequate review.
The documentation states that the system auto-discovers ~/.claude/projects/ session data every 60 seconds, but it does not present this as a prominent privacy-sensitive behavior in the skill description or warnings. Access to home-directory session artifacts may expose conversation metadata, model usage, branches, and cost information, so users need explicit notice before deployment.
The skill advertises direct browser-based editing of SOUL.md, MEMORY.md, and IDENTITY.md with automatic backups, but the description does not foreground that it can modify agent configuration/state files. This is dangerous because these files may control agent behavior or contain sensitive identity and memory data, so unanticipated edits could alter agent actions, corrupt state, or expose confidential information.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
pm2 save pm2 startup
---
The documentation instructs users to pass an API key directly on the command line, which can expose the secret through shell history, terminal logging, CI logs, and process listings visible to other local users or monitoring tools. Because this skill is a command center for AI systems and cloud connectivity, compromise of the API key could allow unauthorized access to the associated workspace or hosted control plane.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Register a deliverable
mc deliver "Report name" --path ./output/report.md
mc deliver "API endpoint" --url https://api.example.com/v1
# List deliverables for a task
mc deliver:list TASK-001
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Or via CLI after server is running:
curl -X POST http://localhost:3000/api/agents \
-H "Content-Type: application/json" \
-d '{"id":"oracle","name":"The Oracle","role":"orchestrator","status":"active"}'
The guide includes destructive reset commands that delete task data and the entire .mission-control/ directory without explicit warnings, confirmation steps, or backup guidance. In an agent-oriented operational dashboard, users may copy-paste these commands and cause irreversible local data loss.
The Telegram integration automatically creates task cards when a message mentions an agent bot, but the documentation does not clearly warn users about this automated side effect. While the feature is not inherently malicious, insufficient disclosure can lead to unexpected task injection, spam, or workflow manipulation from external messaging inputs.
No suspicious patterns detected.