letcairn.work

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:33 AM UTC
• Version: 1.0.2

Overview

Cairn is a disclosed markdown-based project-management skill, but users should understand it installs an external CLI and creates persistent agent-readable files.

Install only if you trust the cairn-work npm package and are comfortable with a CLI creating and updating markdown files under a Cairn workspace. Prefer a project-specific path, review generated AGENTS.md and .cairn/planning.md before letting agents rely on them, and avoid using automatic upgrades without checking the package version and release source.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Global Dependency Installation and Unreviewed Automatic Upgrade

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-18, SKILL.md:47-48, README.md:9-16, README.md:278-288, README.md:588-589
Vulnerability Type: Unpinned third-party dependency and unsafe upgrade workflow
Risk Level: Medium

Vulnerable Code

SKILL.md:11-18:

markdown

## Installation

```bash
npm install -g cairn-work
cairn onboard

cairn onboard creates ~/cairn/ with auto-generated context files (AGENTS.md and .cairn/planning.md) that agents read automatically.

text

`SKILL.md:47-48`:

```markdown
- `cairn update-skill` — Refresh context files after CLI updates
- `cairn upgrade` — Update CLI to latest version

README.md:9-16:

markdown

## Setup

```bash
npm install -g cairn-work
cairn onboard

This creates a workspace and writes two context files your agent reads automatically:

text

`README.md:278-288`:

```markdown
### `cairn update-skill`

Refresh `AGENTS.md` and `.cairn/planning.md` with the latest templates (e.g., after a CLI update).

```bash
cairn update-skill

cairn upgrade

Check for a new CLI version and install it.

text

`README.md:588-589`:

```bash
cairn update-skill        # Refresh templates after CLI update
cairn upgrade             # Update to latest CLI version

Technical Analysis

The installation command does not specify an exact cairn-work version, integrity digest, lockfile, or reviewed release identifier. It installs the package globally, exposing npm installation lifecycle behavior and the resulting executable to the invoking user's filesystem permissions.

The documented cairn upgrade workflow compounds this risk by replacing the installed executable with an unspecified latest release. The audited project contains only documentation and does not include the package's executable source or dependency manifest. Therefore, the code executed during package installation, onboarding ...[truncated 2102 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cairn-work to an exact reviewed version rather than installing the current latest release:

   bash

   npm install --global --ignore-scripts cairn-work@<reviewed-exact-version>
   

   Only use --ignore-scripts if the package has been verified to operate without installation lifecycle scripts.

2. Publish and verify the expected npm integrity digest or package checksum before installation. Document the package name, exact version, registry, and digest together.

3. Include the CLI source, dependency manifest, and lockfile in the auditable project, or link to an immutable source revision corresponding exactly to the installed package.

4. Prefer a project-local or isolated installation over a global installation. Run the CLI in a restricted environment with only the filesystem and network access necessary for workspace management.

5. Replace automatic latest-version upgrades with an explicit process that:

   • Identifies the proposed version.
   • Reviews release notes and source changes.
   • Verifies provenance and integrity.
   • Requires user approval before installation.
   • Supports rollback to the prior reviewed version.

6. Document all files and network endpoints accessed by onboard, update-skill, and upgrade.

7. Validate generated AGENTS.md and .cairn/planning.md content before allowing an agent to load it. Prevent generated templates from silently changing agent safety constraints or introducing commands unrelated to project management.

8. Use npm provenance verification, registry allowlisting, and dependency scanning in the release and installation process.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · COMMANDS.md (reported line 132)May include surrounding context.

Task Management Commands

cairn create task <slug>

Create a new task (existing command, now with better defaults)

bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly encourages AI agents to read files and execute shell commands through the cairn CLI, including commands that create, modify, and open files. Because this skill is aimed at autonomous or semi-autonomous agents and does not prominently warn users about filesystem modification, command execution, editor launching, or potential effects on adjacent directories such as discovered workers/ folders, it increases the risk of unintended local changes or misuse in permissive agent environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to run cairn onboard, which creates ~/cairn/ and auto-generated files in the user's home directory, but it does not clearly warn about these filesystem changes before the command is presented. This is a real safety issue because agent users may execute onboarding steps without understanding that persistent files and context documents will be created in a global location that other tools or agents may later read.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.