Agent Autonomy Primitives

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:50 PM UTC
• Version: 1.0.0

Overview

The skill openly teaches autonomous task loops, but it asks users to install an unpinned global tool and run recurring agents that execute queued work without clear safety boundaries.

Install only if you are comfortable running an autonomy framework. Pin and verify the ClawVault package before installing, avoid global or privileged installs where possible, run agents in a least-privileged sandbox, restrict the task queue to approved work, and require human approval for destructive, external, financial, credential-related, or irreversible actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Global npm Package Installation Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md:13-18` (repeated in `SKILL.md:171-174`) **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## Prerequisites ```bash npm install -g clawvault clawvault init ``` ``` The same installation pattern is repeated in the quick-start instructions: ```bash # 1. Install and init npm install -g clawvault clawvault init ``` ### Technical Analysis The Skill instructs users to install the latest published version of the third-party `clawvault` npm package globally. The dependency is not pinned to a reviewed version, and the instructions provide no lockfile, integrity hash, package provenance verification, or lifecycle-script restriction. npm packages can run lifecycle scripts during installation. Consequently, the effective code executed by this instruction depends on whichever package version the npm registry resolves at installation time, rather than the version reviewed when this Skill was audited. A compromised maintainer account, malicious future release, registry compromise, or package-name takeover could therefore convert this instruction into arbitrary code execution. The global `-g` installation increases exposure by writing outside the project directory into the configured global npm prefix. No evidence was found that the current `clawvault` package is malicious; the vulnerability is the uncontrolled supply-chain execution path created by the installation guidance. ### Attack Path 1. An attacker compromises the package publisher, registry entry, or another part of the package's dependency chain. 2. The attacker publishes a malicious release under the `clawvault` package name or introduces a malicious transitive dependency. 3. A user follows the Skill instructions and runs `npm install -g clawvault`. 4. npm resolves the unpinned package to the attacker-controlled release and downloads it. 5 ...[truncated 1042 chars]
• Remediation: ## Remediation Suggestions 1. Pin the dependency to a specifically reviewed version, for example: ```bash npm install --save-exact clawvault@<reviewed-version> ``` 2. Install the package as a project-local dependency rather than globally, and invoke it through a package script or a controlled local binary path. 3. Commit `package.json` and `package-lock.json`, then use `npm ci` so dependency resolution is reproducible. 4. Verify package provenance, publisher identity, release signatures where available, and npm registry integrity metadata before installation. 5. Audit both the direct package and its transitive dependencies using an appropriate software-composition-analysis process. 6. Disable lifecycle scripts during acquisition where operationally possible: ```bash npm ci --ignore-scripts ``` If lifecycle scripts are necessary, review them before enabling execution. 7. Perform installation and execution in a least-privileged container, sandbox, or dedicated service account with restricted filesystem and credential access. 8. Update both installation occurrences in `SKILL.md` so the quick-start section does not reintroduce the unsafe command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs an agent to periodically select and execute tasks autonomously ('pick the highest-impact task executable RIGHT NOW' and 'execute it') without any embedded guardrails requiring user approval, scope checks, or action-class restrictions. In the context of an autonomy skill, this increases the chance that an agent will take impactful actions—such as modifying systems, changing files, or triggering external operations—based solely on task metadata, which can lead to unintended or unsafe execution.

Session Persistence

Medium

• Category: Rogue Agent

Content

5. Check for tasks due within 24h — those get priority
```

For cron-based agents, schedule a recurring job:
```
Schedule: every 30 minutes
Action: Read task queue, pick highest priority, execute, report

• Confidence: 88% confidence
• Finding: The skill recommends a recurring cron-style job that continuously wakes the agent, reads a queue, and executes work, creating persistent unattended operation. Session persistence by itself is not always unsafe, but here it is tied directly to autonomous task execution, which can amplify mistakes, enable repeated unintended actions, and reduce opportunities for human oversight.

Static analysis

No suspicious patterns detected.