Bridle

PassAudited by ClawScan on May 1, 2026.

Overview

Bridle appears to do what it says, but it can make persistent changes to AI assistant configurations and install third-party assistant components, so use it deliberately.

Before installing, be comfortable with a tool that can edit your AI assistant configuration directories. Use it for intentional profile changes, inspect GitHub-sourced components before installing them, and back up important configs before force, delete, uninstall, or profile-switch operations.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken command could change or remove an assistant profile or overwrite installed assistant components.

Why it was flagged

These documented commands can switch, delete, or overwrite AI-assistant profile/component state. This is aligned with Bridle's purpose and shown as user-directed CLI usage, but it is high-impact mutation authority.

Skill content
bridle profile switch <harness> <name> ... bridle profile delete <harness> <name> ... bridle install owner/repo --force
Recommendation

Use status, show, and diff commands before changing profiles; avoid --force, delete, or uninstall unless you intentionally want that change.

What this means

Installing an untrusted repository could add new assistant behavior, commands, or MCP configuration that persists after installation.

Why it was flagged

Installing agentic components from GitHub repositories is central to the skill, but the safety of those installed components depends on repository trust and review.

Skill content
Bridle can install skills, agents, commands, and MCPs from GitHub repos and auto-translates paths/configs for each harness.
Recommendation

Install only trusted repositories, inspect component contents before installation, and prefer pinned or reviewed sources where possible.

What this means

A profile can carry forward assistant behavior you no longer intend to use.

Why it was flagged

Saved profiles persist assistant settings across future sessions. This is intended behavior, but persistent configuration can preserve unintended tools, prompts, or MCP settings if not reviewed.

Skill content
Profiles: Saved configurations per harness ... Create profile from current config ... Switch/activate a profile
Recommendation

Review saved profiles with show or diff, keep work and personal profiles separate, and remove stale or untrusted components.