ClawHub
Back to skill

Security audit

letcairn.work

Security checks for vulnerabilities and agentic risk

Overview

Cairn is a disclosed markdown-based project-management skill, but users should understand it installs an external CLI and creates persistent agent-readable files.

Install only if you trust the cairn-work npm package and are comfortable with a CLI creating and updating markdown files under a Cairn workspace. Prefer a project-specific path, review generated AGENTS.md and .cairn/planning.md before letting agents rely on them, and avoid using automatic upgrades without checking the package version and release source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding
Unpinned Global Dependency Installation and Unreviewed Automatic Upgrade## Vulnerability Details **File Location**: `SKILL.md:11-18`, `SKILL.md:47-48`, `README.md:9-16`, `README.md:278-288`, `README.md:588-589` **Vulnerability Type**: Unpinned third-party dependency and unsafe upgrade workflow **Risk Level**: Medium ### Vulnerable Code `SKILL.md:11-18`: ```markdown ## Installation ```bash npm install -g cairn-work cairn onboard ``` `cairn onboard` creates `~/cairn/` with auto-generated context files (`AGENTS.md` and `.cairn/planning.md`) that agents read automatically. ``` `SKILL.md:47-48`: ```markdown - `cairn update-skill` — Refresh context files after CLI updates - `cairn upgrade` — Update CLI to latest version ``` `README.md:9-16`: ```markdown ## Setup ```bash npm install -g cairn-work cairn onboard ``` This creates a workspace and writes two context files your agent reads automatically: ``` `README.md:278-288`: ```markdown ### `cairn update-skill` Refresh `AGENTS.md` and `.cairn/planning.md` with the latest templates (e.g., after a CLI update). ```bash cairn update-skill ``` ### `cairn upgrade` Check for a new CLI version and install it. ``` `README.md:588-589`: ```bash cairn update-skill # Refresh templates after CLI update cairn upgrade # Update to latest CLI version ``` ### Technical Analysis The installation command does not specify an exact `cairn-work` version, integrity digest, lockfile, or reviewed release identifier. It installs the package globally, exposing npm installation lifecycle behavior and the resulting executable to the invoking user's filesystem permissions. The documented `cairn upgrade` workflow compounds this risk by replacing the installed executable with an unspecified latest release. The audited project contains only documentation and does not include the package's executable source or dependency manifest. Therefore, the code executed during package installation, onboarding ...[truncated 2102 chars]
Remediation
## Remediation Suggestions 1. Pin `cairn-work` to an exact reviewed version rather than installing the current latest release: ```bash npm install --global --ignore-scripts cairn-work@<reviewed-exact-version> ``` Only use `--ignore-scripts` if the package has been verified to operate without installation lifecycle scripts. 2. Publish and verify the expected npm integrity digest or package checksum before installation. Document the package name, exact version, registry, and digest together. 3. Include the CLI source, dependency manifest, and lockfile in the auditable project, or link to an immutable source revision corresponding exactly to the installed package. 4. Prefer a project-local or isolated installation over a global installation. Run the CLI in a restricted environment with only the filesystem and network access necessary for workspace management. 5. Replace automatic latest-version upgrades with an explicit process that: - Identifies the proposed version. - Reviews release notes and source changes. - Verifies provenance and integrity. - Requires user approval before installation. - Supports rollback to the prior reviewed version. 6. Document all files and network endpoints accessed by `onboard`, `update-skill`, and `upgrade`. 7. Validate generated `AGENTS.md` and `.cairn/planning.md` content before allowing an agent to load it. Prevent generated templates from silently changing agent safety constraints or introducing commands unrelated to project management. 8. Use npm provenance verification, registry allowlisting, and dependency scanning in the release and installation process.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Content
## Task Management Commands

### `cairn create task <slug>`
Create a new task (existing command, now with better defaults)

```bash
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README explicitly encourages AI agents to read files and execute shell commands through the `cairn` CLI, including commands that create, modify, and open files. Because this skill is aimed at autonomous or semi-autonomous agents and does not prominently warn users about filesystem modification, command execution, editor launching, or potential effects on adjacent directories such as discovered `workers/` folders, it increases the risk of unintended local changes or misuse in permissive agent environments.

Missing User Warnings

Low
Confidence
95% confidence
Finding
The skill instructs users to run `cairn onboard`, which creates `~/cairn/` and auto-generated files in the user's home directory, but it does not clearly warn about these filesystem changes before the command is presented. This is a real safety issue because agent users may execute onboarding steps without understanding that persistent files and context documents will be created in a global location that other tools or agents may later read.

Static analysis

No suspicious patterns detected.