Cross-Agent Treaty Broker

• Outcome: Review
• Latest audit: Oct 20, 2026 · 5:06 PM UTC
• Version: 2.0.0

Overview

This skill needs review because crafted treaty files can overwrite other JSON files, routine commands erase audit anchors, and promised confirmation checks are missing.

Wait for path containment, anchor preservation, and confirmation safeguards before relying on this skill for consent or auditing. If evaluating it, use an isolated directory with disposable records and trusted treaty files, and pin installation versions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/catcb.py

Finding

Imported treaty IDs permit writes outside treaty storage

Content

View full analysis

Impact

The attacker can overwrite writable JSON files outside treaty storage with attacker-controlled JSON. For example, treaty_id '../../manifest' targets the project's manifest.json. Existing treaty IDs also overwrite prior records without a collision check. Writes require an existing parent directory and remain limited by the process's filesystem permissions and the appended .json suffix.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/catcb.py

Finding

Routine commands silently destroy existing audit anchors

Content

View full analysis

Impact

Previously recorded hashes, signing times, and signer records are lost. audit clears the evidence before attempting to read it; signing another treaty preserves only the newly added anchor. This defeats the advertised hash-anchored audit history.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/catcb.py

Finding

Signing and destructive revocation lack the promised confirmation gate

Content

View full analysis

Impact

A direct invocation can record approval that was not separately confirmed or delete a treaty before the promised confirmation. Revocation removes the treaty document rather than retaining a revoked record. These operations do not themselves grant capabilities or transfer data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Local treaty storage and logging support the declared purpose, but the central consent-loop claim is not implemented. The sign command immediately writes an agent_a signature using --signer or a default identity; it neither prompts for confirmation nor requires prior review or agent_b consent. No agent communication, response handling, or iterative negotiation is present. Additionally, ensure_setup() overwrites the anchor registry on every command, erasing previous anchors and preventing persistent anchor-based auditing. No network access or unrelated external activity is shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The entire supplied implementation is an installation command, not negotiation functionality. Although installation can support a skill, no subsequent invocation or implementation establishes the declared behavior here. The package name alone does not demonstrate negotiation or consent loops, and the installed package's behavior cannot be assessed from this chunk.

Content

No source excerpt is available for this finding.

Treaty signing does not enforce the documented human confirmation requirement.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The signing function immediately records a signature without requesting human approval or verifying that the treaty was reviewed, despite explicitly documenting a human-confirmation requirement. Any agent able to invoke the CLI can mark a treaty as signed and supply an arbitrary signer identity; this undermines the skill's central consent guarantee, although actual downstream capability enforcement is not shown.

Content

No source excerpt is available for this finding.

The audit command erases the anchor history it is documented to display.

High

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

The audit command calls ensure_setup(), which unconditionally opens the anchor registry in write mode and replaces it with an empty registry before the audit reads it. Other commands also trigger this reset, destroying historical signing evidence and undermining accountability in a consent-focused treaty broker; an operator or agent can erase anchor history simply by invoking an otherwise read-only command.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx clawhub'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command executes an unpinned external CLI through npx and also requests the skill using the mutable @latest tag. A compromised or malicious future release could execute with the installing user's privileges; this is a supply-chain risk, although the referenced CLI is not demonstrated to be an MCP server.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx clawhub'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command invokes an unpinned npm CLI through npx and installs the skill using the mutable @latest tag, allowing the code obtained during installation to change without review. A compromised upstream release could execute with the installing user's permissions; the documented human-approval and local-first safeguards do not protect the installation process. Although the finding incorrectly describes clawhub as an MCP server, its underlying supply-chain concern is valid.

Content

No source excerpt is available for this finding.