Security checks for vulnerabilities and agentic risk
Overview
The skill openly teaches autonomous task loops, but it asks users to install an unpinned global tool and run recurring agents that execute queued work without clear safety boundaries.
Install only if you are comfortable running an autonomy framework. Pin and verify the ClawVault package before installing, avoid global or privileged installs where possible, run agents in a least-privileged sandbox, restrict the task queue to approved work, and require human approval for destructive, external, financial, credential-related, or irreversible actions.
The same installation pattern is repeated in the quick-start instructions:
```bash
# 1. Install and init
npm install -g clawvault
clawvault init
Technical Analysis
The Skill instructs users to install the latest published version of the third-party clawvault npm package globally. The dependency is not pinned to a reviewed version, and the instructions provide no lockfile, integrity hash, package provenance verification, or lifecycle-script restriction.
npm packages can run lifecycle scripts during installation. Consequently, the effective code executed by this instruction depends on whichever package version the npm registry resolves at installation time, rather than the version reviewed when this Skill was audited. A compromised maintainer account, malicious future release, registry compromise, or package-name takeover could therefore convert this instruction into arbitrary code execution.
The global -g installation increases exposure by writing outside the project directory into the configured global npm prefix. No evidence was found that the current clawvault package is malicious; the vulnerability is the uncontrolled supply-chain execution path created by the installation guidance.
Attack Path
An attacker compromises the package publisher, registry entry, or another part of the package's dependency chain.
The attacker publishes a malicious release under the clawvault package name or introduces a malicious transitive dependency.
A user follows the Skill instructions and runs npm install -g clawvault.
npm resolves the unpinned package to the attacker-controlled release and downloads it.
5
...[truncated 1042 chars]
Remediation
View remediation
Remediation Suggestions
Pin the dependency to a specifically reviewed version, for example:
bash
Install the package as a project-local dependency rather than globally, and invoke it through a package script or a controlled local binary path.
Commit package.json and package-lock.json, then use npm ci so dependency resolution is reproducible.
Verify package provenance, publisher identity, release signatures where available, and npm registry integrity metadata before installation.
Audit both the direct package and its transitive dependencies using an appropriate software-composition-analysis process.
Disable lifecycle scripts during acquisition where operationally possible:
bash
npm ci --ignore-scripts
If lifecycle scripts are necessary, review them before enabling execution.
Perform installation and execution in a least-privileged container, sandbox, or dedicated service account with restricted filesystem and credential access.
Update both installation occurrences in SKILL.md so the quick-start section does not reintroduce the unsafe command.
The skill explicitly instructs an agent to periodically select and execute tasks autonomously ('pick the highest-impact task executable RIGHT NOW' and 'execute it') without any embedded guardrails requiring user approval, scope checks, or action-class restrictions. In the context of an autonomy skill, this increases the chance that an agent will take impactful actions—such as modifying systems, changing files, or triggering external operations—based solely on task metadata, which can lead to unintended or unsafe execution.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
88% confidence
Finding
The skill recommends a recurring cron-style job that continuously wakes the agent, reads a queue, and executes work, creating persistent unattended operation. Session persistence by itself is not always unsafe, but here it is tied directly to autonomous task execution, which can amplify mistakes, enable repeated unintended actions, and reduce opportunities for human oversight.
Content
Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.
Check for tasks due within 24h — those get priority
