T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:167- Finding
Unpinned Remote Shell Script Is Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Cavepony
Security checks for vulnerabilities and agentic risk
Overview
Cavepony is a disclosed text-compression/style skill, but its documented install path can persistently change future agent behavior and uses unsafe remote execution examples.
Install only if you intentionally want persistent Cavepony behavior in your agent. Avoid the README's curl-to-bash command and unpinned npx examples; prefer reviewed local files or pinned release artifacts. Do not use the file-compression command on important originals without a separate backup, especially non-.md files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T01 · Skill Instruction Hijacking
Error
- Location
hooks/install.sh:33- Finding
Persistent Session-Start Hook Injects Agent System-Prompt Instructions
- Content
View full analysis
"$CAVEPONY_HOOK" << 'EOF' // Cavepony hook for Claude Code // Auto-activates cavepony mode on session start module.exports = { name: 'Cavepony', description: 'Auto-activate cavepony mode on session start', onSessionStart: async (context) => { // Add cavepony rules to the session await context.addSystemPrompt(` Terse like cavepony. Technical substance exact. Only fluff die. Drop: articles, filler (just/really/basically), pleasantries, hedging. Fragments OK. Short synonyms. Code unchanged. Pattern: [thing] [action] [reason]. [next step]. Pony substitutions: human/people -> pony/ponies, man/woman -> stallion/mare, boy/girl -> colt/filly, child/children -> foal/foals, hand/foot -> hoof/hooves, hey -> hay, hell/heck -> hay, Christmas -> Heartswarming, New York -> Manehattan, Philadelphia -> Fillydelphia, etc. ACTIVE EVERY RESPONSE. No revert after many turns. No filler drift. Code/commits/PRs: normal. Off: "stop cavepony" / "normal mode". `); // Set status line indicator context.setStatusLine('[CAVEPONY]'); console.log('🏍️ Cavepony mode activated!'); } }; EOF ``` The PowerShell installer implements the same behavior: ```powershell $HookContent = @' // Cavepony hook for Claude Code // Auto-activates cavepony mode on session start module.exports = { name: 'Cavepony', description: 'Auto-activate cavepony mode on session start', onSessionStart: async (context) => { await context.addSystemPrompt(` Terse like cavepony. Technical substance exact. Only fluff die. Drop: articles, filler (just/really/basically), pleasantries, hedging. Fragments OK. Short synonyms. Code unchanged. Pattern: [thing] ...[truncated 2881 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:20- Finding
Unpinned npx Commands Execute Mutable Registry Packages
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
cavepony-compress/bin/cavepony:47- Finding
Backup Path Bug Causes Destructive Overwrite of Non-Markdown Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node cavepony-compress/bin/cavepony text "Hello human!" --mode=pony
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node cavepony-compress/compress.js roundtrip "I would be happy to help with that."
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node cavepony-compress/compress.js roundtrip "I would be happy to help with that."
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node cavepony-compress/compress.js roundtrip "I would be happy to help with that."
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node cavepony-compress/compress.js roundtrip "I would be happy to help with that."
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The README instructs users to execute
npx caveponywithout pinning an exact package version. That allows whatever version is currently published under that package name to run, creating a supply-chain risk if a future release is compromised, malicious, or simply breaking. In an agent/CLI integration context, this is more dangerous because users may copy-paste and execute it directly with elevated trust.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
This example again uses
npx caveponywithout an exact version, so the command will fetch and execute the latest published package. If the package or publisher account is compromised, users and agents following the README could run attacker-controlled code. Because this is presented as a quick-start command, it increases the chance of blind execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
The unpinned
npx cavepony compresscommand introduces the same supply-chain execution risk as the othernpxexamples. Users may believe they are only running a documented utility, but in practice they are executing whatever package version resolves at that moment. In an AI-agent ecosystem, this risk is amplified because tool installation commands may be followed automatically or with reduced scrutiny.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 89% confidence
- Finding
This
npx cavepony textexample is also unpinned and therefore subject to arbitrary future package changes or compromise. README-based copy-paste execution is a common infection path in package-ecosystem attacks, making this a real though moderate supply-chain vulnerability. The skill context makes it more sensitive because it targets AI-agent users who may automate setup steps.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README tells users to add a prompt that forces the agent into an always-on response style until manually disabled. That is not code execution, but it is a prompt-safety issue because it persistently overrides normal agent behavior and user expectations without per-task consent. In a skill context, this can degrade instruction hierarchy, reduce transparency, and interfere with safety or usability across unrelated tasks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README includes
bash <(curl -s ...), which downloads remote content and executes it immediately without review, pinning, checksum verification, or a warning. This is a classic high-risk supply-chain pattern: compromise of the repository, network path, or referenced script can lead to arbitrary code execution on the user's machine. The agent-skill context increases danger because it is framed as a convenient auto-activation step for tool integration.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes an always-on system prompt snippet that forces a persistent response style and specific vocabulary substitutions across every response, with instructions like 'ACTIVE EVERY RESPONSE' and 'No revert after many turns.' This can override user expectations, degrade instruction fidelity, and cause unsafe semantic drift in normal interactions, especially where exact wording or neutral language matters.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file defines unconditional prefixes and suffixes that impose a Canterlot-themed speaking style on output without any indication of user consent or runtime opt-in. While not a traditional security exploit, this is a genuine policy and integrity issue because it can silently alter assistant responses, misrepresent tone, and reduce reliability in contexts where faithful wording matters.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The docstring says token compression is "Fully reversible with expand()", but compressTokens later removes the sentinel delimiters at L124-L125 and also includes optional destructive transformations such as dropFiller, dropArticles, and ultra at L84-L122. While expand() can reverse token substitutions in many cases, the documented guarantee is broader than the actual behavior of this function.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This JSON defines broad mandatory substitutions that rewrite ordinary English terms such as people, men, women, Christmas, and geographic names into pony-themed equivalents. Because the file provides no indication of optional use, user choice, or context restriction, it represents a natural-language style/locale constraint being imposed by configuration.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON manifest consists entirely of hard-coded English phrases such as 'in order to', 'I think', and 'I'm sorry', implying the skill is designed to operate on English output only. Because the file does not document that the behavior is English-only or provide any locale/language opt-in, it can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installed hook injects a persistent system prompt on every session start that forces a response style and explicitly says it is active for every response until special opt-out text is used. This changes assistant behavior without clear per-session user consent, creating a prompt-persistence and user-expectation risk that can interfere with normal operation, policy interpretation, or downstream workflows that rely on unmodified responses.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The hook installs code that automatically injects a system prompt on every session start, forcing persistent response-style and vocabulary changes without explicit per-session user consent. Because system prompts have high authority, this alters agent behavior globally and can override user expectations or degrade clarity, making it a real prompt-injection style behavior even if the content is non-malicious.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The comment describes compress() as the main compression entry point returning "Compressed text", but the documented mode set includes 'canterlot', and the implementation returns expandToCanterlot(text) for that mode at L222-L225. That mode expands/stylizes input rather than compressing it, so the documentation contradicts actual behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file instructs that 'every response' must follow the cavepony style when the mode is active, including altered wording and telegraphic compression. This imposes a specific language/register transformation that could conflict with organizational language/locale preferences unless the user explicitly opted into that mode.
- Content