tick-md

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:19 AM UTC
• Version: 1.3.3

Overview

This is a disclosed task-coordination skill, but users should be aware it can change local task files and relies on globally installed npm tools.

Install only if you want an agent to maintain project task state in TICK.md. Prefer pinned or locally reviewed versions of tick-md and tick-mcp-server, approve MCP config edits deliberately, keep the MCP server scoped to the intended project, and ask the agent to confirm before delete, force-delete, direct status edits, undo, or remote push operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:7
• Finding: Unpinned Global npm Dependencies Create a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `INSTALL.md:7-14` **Additional Locations**: `mcp-reference.md:5-8`, `README.md:20-22`, `README.md:146-147` **Vulnerability Type**: Unpinned third-party dependencies installed globally **Risk Level**: Medium **Vulnerable Code**: ```bash ### Step 1: Install CLI npm install -g tick-md ### Step 2: Install MCP Server npm install -g tick-mcp-server ``` Related installation instructions also include: ```bash npm install -g clawhub npm install -g tick-md tick-mcp-server ``` ### Technical Analysis The installation instructions retrieve mutable latest versions of third-party npm packages and install them globally. They do not specify exact reviewed versions, integrity hashes, a lockfile, or another reproducible verification mechanism. npm installation may execute package lifecycle scripts. A globally installed package can place executable commands in the user's global npm binary directory. The `tick-mcp-server` package is subsequently configured as an MCP process, giving the downloaded implementation access to the project context and documented task and Git operations. The Skill package contains documentation rather than the source code of these dependencies. Consequently, auditing this repository does not establish that the code eventually downloaded from npm is equivalent to a previously reviewed release. ### Attack Path 1. An attacker compromises the npm publisher account, package contents, or another component in the dependency supply chain. 2. The attacker publishes a malicious version under one of the package names referenced by the Skill. 3. A user follows the documented unversioned global installation command. 4. npm resolves the command to the compromised latest release. 5. Malicious lifecycle code may execute during installation under the installing user's account. 6. If the compromised MCP server is configured, it may execute again whenever the editor ...[truncated 1027 chars]
• Remediation: ## Remediation Suggestions 1. Pin every dependency to an exact reviewed version, for example: ```bash npm install -g tick-md@<reviewed-version> npm install -g tick-mcp-server@<reviewed-version> ``` 2. Publish trusted package provenance, expected integrity hashes, and verified npm publisher information in the installation guide. 3. Prefer a project-local installation with a committed lockfile over global installation where the supported environment permits it. 4. Acquire and inspect packages without lifecycle scripts first, where operationally feasible, before allowing installation scripts to run. 5. Run the MCP server with narrowly scoped filesystem and network access rather than the user's unrestricted environment. 6. Restrict the MCP process to the intended project directory and avoid exposing credentials or unrelated repositories to it. 7. Document a dependency update and re-audit process so pinned versions are upgraded only after source, provenance, and package contents have been reviewed. 8. Apply the same version-pinning and provenance requirements to the `clawhub` publishing CLI documented in `README.md`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Self-Modification

High

• Category: Rogue Agent

Content

```bash
# Example: publish v1.0.1
# 1. Edit skill.json: "version": "1.0.1"
# 2. Add entry to CHANGELOG.md
# 3. Publish
clawhub publish .

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Example: publish v1.0.1
# 1. Edit skill.json: "version": "1.0.1"
# 2. Add entry to CHANGELOG.md
# 3. Publish
clawhub publish .
```

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option 2: Use workspace skills
```bash
# In your project
mkdir -p skills
cp -r . skills/tick-md/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents destructive deletion operations (`tick delete`, including `--force`) without consistently requiring explicit user confirmation or warning that these commands mutate and may irreversibly remove task data. In an agent setting, this increases the chance that an assistant executes destructive actions from ambiguous user prompts or as part of an automated workflow, causing accidental project-state loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill encourages automatic task creation from natural-language requests without warning that this writes to `TICK.md` and changes repository state. In practice, that can lead an agent to perform unapproved file modifications from conversational input that the user may have intended as discussion rather than authorization to edit project artifacts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The reference documents a destructive delete capability, including a force option that can remove tasks even when dependents exist, but it does not warn users about irreversible state loss or coordination impact. In an agent skill context, this increases the chance that an autonomous agent may delete active planning data or break dependency tracking without explicit operator awareness.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool explicitly allows direct task edits while bypassing state machine validation, which can undermine workflow integrity, dependency correctness, and auditability. In an AI-agent setting this is especially risky because an agent may use the shortcut to place tasks into invalid or misleading states that affect other agents' decisions.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The undo capability reverts the most recent tick commit, which changes repository state, but the documentation does not clearly warn about side effects such as reverting another agent's work or altering shared history. In a coordinated multi-agent environment, an agent could invoke this operation based on incomplete context and unintentionally roll back legitimate changes.

Static analysis

No suspicious patterns detected.