Pine Assistant

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:38 PM UTC
• Version: 1.2.0

Overview

The skill is purpose-aligned with Pine, but it grants broad authority to inspect task history and start real-world actions, so users should review it carefully before installing.

Install only if you are comfortable letting Pine receive task details and potentially act on your behalf through calls, emails, browser automation, and account workflows. Before use, prefer explicit confirmation before creating sessions, sending sensitive account data, starting tasks, using background polling, or deleting sessions, and consider pinning or otherwise verifying the pineai-cli package.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party CLI Dependency Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: Unpinned executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🤖","requires":{"bins":["pine"]},"install":{"pip":{"package":"pineai-cli"}}}} ``` ### Technical Analysis The skill declares `pineai-cli` as an installable Python dependency without specifying an exact version, package hash, trusted artifact URL, or provenance requirement. Consequently, the code installed under the `pine` executable name can change independently of the reviewed skill. Because the dependency supplies a command-line program that the agent is instructed to execute extensively, compromise of the package publisher account, package repository, or a future release could introduce arbitrary code into the skill's execution path. The reviewed project does not itself contain evidence that the current package is malicious; the vulnerability is the absence of controls ensuring that the installed artifact is the same artifact that was audited. ### Attack Path 1. An attacker compromises the package publisher, package distribution account, or another relevant supply-chain component. 2. The attacker publishes a malicious release of `pineai-cli`. 3. A skill installation or update resolves the unversioned dependency to the malicious release. 4. The agent invokes the installed `pine` executable as directed by `SKILL.md`. 5. Malicious package code executes with the operating-system permissions and environment access of the agent process. ### Impact Assessment A compromised dependency could access resources available to the agent process, potentially including Pine credentials stored under `~/.pine/config.json`, user task details, account information supplied to the CLI, local files readable by the process, and accessible network services. It could also falsify CLI responses or perform unauthorized network activity. The attainable privileges are limited b ...[truncated 147 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `pineai-cli` to an exact, security-reviewed version rather than accepting the latest available release. - Require a cryptographic hash for the selected package artifact, using a hash-locked requirements file or an equivalent package integrity mechanism. - Verify the package publisher, repository ownership, release signatures, and build provenance before deployment. - Install and execute the dependency in a restricted environment with minimal filesystem and network permissions. - Prevent the CLI process from reading unrelated secrets or files. - Establish a controlled update process in which each new dependency version is reviewed and tested before the pin is changed. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:15
• Finding: Overbroad Mandatory Instructions Delegate Agent Decisions and Session Data to an External Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-31`, with related delegation instructions at `SKILL.md:92` and `SKILL.md:310` **Vulnerability Type**: Overbroad skill-level behavioral instructions **Risk Level**: Medium ### Vulnerable Code ```markdown ## CRITICAL: Always look up active sessions first **NEVER claim you don't know about a session or task.** Before creating a new session, answering questions about Pine tasks, or saying you have no context, you MUST run: ```bash pine sessions list --json ``` **Mandatory session lookup triggers:** - The user mentions anything that could relate to a Pine task (a company name, account, refund, call, booking, etc.) - The user asks you to do something that Pine could handle — check if a session already exists - The user asks about progress, status, or follow-up on any task - You are about to create a new session — verify no existing session covers the same task **NEVER do any of these without listing sessions first:** - Say "I don't have context about that" or "Can you remind me?" - Create a duplicate session for a task that already exists - Assume a task doesn't exist because you don't remember it ``` Related external-delegation instructions include: ```markdown If the user asks Pine to do something, let Pine decide whether it can handle it — don't preemptively reject requests based on assumptions about Pine's capabilities. ``` ```markdown 8. **Don't preemptively reject requests** — let Pine decide whether it can handle a task. ``` ### Technical Analysis The skill uses unconditional directives such as `MUST`, `NEVER`, and `Always` to alter the agent's behavior whenever a broadly related topic is mentioned. The trigger includes generic subjects such as company names, accounts, refunds, calls, and bookings. This scope can cause Pine session enumeration even when the user has not explicitly requested that the external Pine service be used for the current interaction. The instruction to “let ...[truncated 2240 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Activate Pine only when the user explicitly requests Pine or clearly consents to using the external service for the current task. - Narrow session lookup triggers to unambiguous Pine-related follow-ups instead of generic mentions of companies, accounts, calls, refunds, or bookings. - Before transmitting personal, financial, account, or task information, identify what will be sent and obtain informed user consent. - Replace “let Pine decide” with a requirement that the host agent independently applies authorization, safety, privacy, legality, and capability checks before delegation. - Add an explicit statement that system and platform policies, user authorization, and least-privilege requirements always take precedence over skill instructions and external-service responses. - Minimize data sent to Pine and redact unrelated session details and credentials. - Require explicit confirmation immediately before consequential actions such as cancellations, purchases, reservations, disputes, account changes, or communications made in the user's name. - Treat all Pine responses as untrusted external content and prevent them from overriding higher-priority instructions or expanding the authorized task scope. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The mandatory session lookup trigger is overly expansive, telling the agent to query all active sessions whenever the user mentions almost anything that could relate to a Pine task. This can unnecessarily expose prior task metadata across unrelated conversations and encourages cross-session context retrieval even when the user has not clearly asked to access an existing task.

Session Persistence

Medium

• Category: Rogue Agent

Content

- The user mentions anything that could relate to a Pine task (a company name, account, refund, call, booking, etc.)
- The user asks you to do something that Pine could handle — check if a session already exists
- The user asks about progress, status, or follow-up on any task
- You are about to create a new session — verify no existing session covers the same task

**NEVER do any of these without listing sessions first:**
- Say "I don't have context about that" or "Can you remind me?"

• Confidence: 84% confidence
• Finding: The skill treats session history as a persistent memory source and forbids the agent from saying it lacks context, pushing it to consult prior sessions before many actions. This increases the chance of inappropriate reuse of historical task data, confusion between separate user matters, and disclosure of sensitive prior-session information not needed for the current request.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill encourages invoking Pine for a very broad class of requests, including ordinary search, discovery, outreach, and online tasks, with guidance to 'let Pine decide' rather than requiring clear user intent. In a terminal agent context, that can cause over-triggering of an external action-taking service and unintended disclosure of user data or initiation of real-world actions when the user may only be asking informational questions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Pine asks for scheduling confirmation — the user must be available
- Pine asks for any information you were not given by the user

### RESPOND to Pine (without asking user) when:
- Payment confirmed or no payment needed → run `pine task start SESSION_ID`
- Task auto-started → just tell the user the task has started (do NOT run task start)
- Task finished → share results with the user

• Confidence: 81% confidence
• Finding: The instruction to respond to Pine and start tasks 'without asking user' after payment/no-payment states authorizes an external service to begin acting autonomously. Even if billing is settled, task execution can trigger calls, emails, browser automation, or account actions that the user may expect to explicitly approve at the final handoff.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill exposes session deletion commands, including forced deletion, without warning about irreversibility, audit loss, or the need for explicit user confirmation. In an agentic environment, destructive commands documented as routine capabilities can be invoked carelessly and permanently remove task history needed for recovery, compliance, or dispute resolution.

Static analysis

No suspicious patterns detected.