proof-of-work

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:46 AM UTC
• Version: 1.9.19

Overview

The skill is a coherent proof-of-work checklist, but it needs Review because its examples encourage unpinned/global tool execution, background services without cleanup, and raw environment/auth output capture.

Install only if you are comfortable with a validation skill that may prompt agents to run local commands. Prefer pinned, project-local tools over @latest or global npm installs; do not capture secret environment values or raw auth/account output in evidence logs; and ensure any background service started for validation is stopped afterward.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: modules/validation-protocols.md:27

Finding

Unpinned npm Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: modules/validation-protocols.md:27-29, 57-58, 95, 100; modules/red-flags.md:16
Vulnerability Type: Supply-chain exposure through mutable and unpinned npm packages
Risk Level: Medium

Vulnerable Code

From modules/validation-protocols.md:

bash

CCLSP_CONFIG_PATH=./config.json npx cclsp@latest &
sleep 2
ps aux | grep cclsp

bash

npm install -g cclsp
echo $?  # Must be 0

bash

npx cclsp@latest --help

bash

CCLSP_CONFIG_PATH=config.json npx cclsp@latest &

From modules/red-flags.md:

bash

CCLSP_CONFIG_PATH=config.json npx cclsp@latest

Technical Analysis

The validation instructions encourage agents to use npx cclsp@latest, which resolves and executes a mutable package release at runtime. Consequently, the code that executes is not fixed to the version reviewed with this Skill. The global installation example, npm install -g cclsp, is also unversioned and modifies the host environment.

No lockfile, exact version, package-integrity hash, trusted publisher verification, or isolated execution environment is specified. npm package binaries and installation lifecycle scripts may execute with the invoking user's privileges. A compromised package, publisher account, registry response, or unexpectedly changed release could therefore introduce code absent from the audited project.

Other unpinned tool invocations in the same document, such as npx tsc, carry a similar dependency-resolution concern if the package is not already installed from a trusted, locked dependency tree.

Attack Path

1. An agent follows the Skill's validation protocol.
2. It runs npx cclsp@latest or installs the unversioned package globally.
3. npm resolves the package from the external registry at execution time.
4. A compromised or malicious current release supplies installation scripts or a package binary.
5. npm or npx executes that code with the agent user's permissions.
6. The pay ...[truncated 777 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest and unversioned installations with an exact, reviewed version:

   bash

   npm install --save-exact cclsp@X.Y.Z
   

2. Commit and enforce a lockfile, and use npm ci rather than unconstrained installation.
3. Verify registry package ownership, provenance, and integrity before use.
4. Avoid global installation. Install dependencies in an isolated temporary project, container, or restricted development environment.
5. Prefer execution from an already locked local dependency tree:

   bash

   npx --no-install cclsp --help
   

6. Pin all other npx tools to reviewed local dependencies rather than permitting implicit registry downloads.
7. Run third-party package code with minimum privileges, restricted credentials, limited network access, and no sensitive environment variables.

T09 · Insecure Skill Coding Practices

Note

• Location: modules/validation-protocols.md:27

Finding

Validation Examples Leave Background Services Running

Content

View full analysis

Vulnerability Details

File Location: modules/validation-protocols.md:27-29, 100
Vulnerability Type: Unmanaged background process lifecycle
Risk Level: Low

Vulnerable Code

bash

CCLSP_CONFIG_PATH=./config.json npx cclsp@latest &
sleep 2
ps aux | grep cclsp

A second integration example similarly starts the service without cleanup:

bash

CCLSP_CONFIG_PATH=config.json npx cclsp@latest &

Technical Analysis

The examples start cclsp asynchronously using & but do not capture the resulting PID, register a cleanup trap, impose a timeout, or terminate the service after validation. An agent following these instructions can therefore leave the third-party process running after the check completes.

This is not confirmed cross-session system persistence because the Skill does not install a startup service, scheduled task, or boot hook. It is nevertheless insecure process management: repeated validations may create stale processes, occupied ports, resource consumption, and environmental state that influences subsequent tests.

The process being left running is also sourced through the unpinned npx ...@latest path described in the separate supply-chain finding, increasing the significance of failing to terminate it.

Attack Path

1. An agent runs the documented validation command.
2. The shell starts cclsp in the background.
3. The protocol verifies process presence with ps.
4. Validation finishes without sending a termination signal.
5. The process continues running with the invoking user's privileges until it exits independently, is manually terminated, or the environment is destroyed.
6. Repeated runs can leave multiple processes or allow a compromised dependency to remain active longer than necessary.

Impact Assessment

The immediate impact is limited to the invoking user's process context. Potential effects include CPU and memory consumption, occupied local ports, stale service state, interference with later va ...[truncated 201 chars]

Remediation

View remediation

Remediation Suggestions

1. Capture the background PID and guarantee cleanup:

   bash

   CCLSP_CONFIG_PATH=./config.json npx --no-install cclsp &
   pid=$!
   trap 'kill "$pid" 2>/dev/null || true; wait "$pid" 2>/dev/null || true' EXIT
   
   sleep 2
   ps -p "$pid"
   

2. Use a bounded execution mechanism such as timeout where supported.
3. Terminate and wait for the exact PID rather than using broad process-name matching.
4. Run the service in an isolated container or temporary test environment.
5. Check that the selected port is available before startup and verify that cleanup releases it.
6. Document cleanup as a mandatory validation step and report cleanup failures as test failures.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list includes very generic terms such as "validation," "testing," "proof," and "acceptance-criteria," which are likely to appear in ordinary software conversations. This can cause the skill to activate unintentionally and inject strong procedural instructions into unrelated workflows, creating prompt-scope interference and increasing the chance of unnecessary or disruptive behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file defines activation patterns using generic terms like "evidence," "proof," "trace," and phrases such as "show your work" and "document the steps taken." In review contexts these are common everyday expressions, and the file does not provide constraints or negative examples to clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The markdown includes an example command using npx cclsp@latest, which fetches and executes the latest package version at runtime instead of a fixed, reviewed version. In a proof-of-work skill, users are explicitly encouraged to run shown commands as validation steps, so this creates a realistic supply-chain risk if the package changes unexpectedly or is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

Using npx tsc --noEmit file.ts without an explicit version can cause execution of whatever TypeScript package resolves in the environment, potentially fetching or invoking an unexpected tool version. In a validation skill that encourages users to run commands, this creates a supply-chain and reproducibility risk, especially on systems where local dependencies are absent or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The protocol tells users to print environment variables directly with echo $REQUIRED_VAR and separately instructs capturing command output as evidence. If the variable contains secrets, tokens, keys, or internal endpoints, this guidance can expose sensitive values in terminal history, logs, screenshots, chat transcripts, or review artifacts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · modules/validation-protocols.md (reported line 239)May include surrounding context.

3. Check network connectivity (if applicable)

   bash

   ping -c 1 required-service.com
   curl -I https://api.example.com/health
   

4. Validate credentials/auth (if applicable)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Credential validation commands like gh auth status and aws sts get-caller-identity can reveal usernames, account IDs, active profiles, tenant details, and other sensitive authentication context. Because the skill also mandates recording command output as evidence, it increases the chance that this information is unnecessarily disclosed or retained.

Content

No source excerpt is available for this finding.