Stoicism Daily Practice

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:29 AM UTC
• Version: 1.0.0

Overview

The skill is mostly Stoic coaching content, but it asks for unnecessary local filesystem access and uses an unpinned installer command that deserves review before use.

Review this before installing. Prefer a pinned, trusted installer path, avoid granting filesystem access unless the platform requires it, and treat cold exposure, skipping meals, sleeping on the floor, or weather exposure as optional practices that should be avoided when health, eating-disorder history, age, or unsafe conditions make them risky.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

install: "npx clawhub install stoicism-daily-practice"

Technical Analysis

The installation instruction invokes clawhub through npx without specifying an exact package version, integrity hash, lockfile, or trusted registry. Depending on the local npm configuration and cache state, npx can retrieve and execute the package version currently resolved by the configured registry.

This makes the code executed during installation mutable after the Skill has been reviewed. If the clawhub package, its publishing account, one of its transitive dependencies, or the configured registry is compromised, installation could execute attacker-controlled package code. The reviewed project does not itself contain an embedded malicious script, so this finding concerns supply-chain exposure rather than confirmed malicious behavior.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, a transitive dependency, or a registry used by the victim.
2. The attacker publishes or serves a malicious version that satisfies the unversioned package request.
3. A user or automated system follows the documented installation command.
4. npx resolves and downloads the attacker-controlled package or dependency.
5. Package lifecycle hooks or CLI entry-point code execute with the privileges of the user running the command.
6. The malicious code can perform any operation permitted to that user.

Impact Assessment

Successful exploitation permits arbitrary code execution in the installation process under the invoking user's operating-system privileges. Potential scope includes reading or modifying files accessible to that account, accessing environment variables and locally available credentials, altering project files, and making network requests ...[truncated 227 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer to an explicitly reviewed version, for example by using npx clawhub@<exact-version> ....
2. Use a lockfile and verify package integrity through registry integrity metadata or independently published checksums.
3. Explicitly configure and document the trusted npm registry rather than relying on ambient user configuration.
4. Review the pinned package, its lifecycle scripts, and its complete transitive dependency tree before approving installation.
5. Prefer installing dependencies in a restricted environment and invoke a locally pinned binary rather than dynamically downloading and executing the latest package.
6. Run installation with least privilege, without administrator rights, production credentials, or unnecessary access to sensitive directories.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

md

- The dichotomy of control is a muscle, not a revelation. You'll understand it the first time you hear it. You'll practice it imperfectly for years. That's the point.
- Morning preparation + evening review is the minimum viable Stoic practice. If you do nothing else, do those two things for 30 days.
- Read one page of Marcus Aurelius's "Meditations" each morning. It was written as daily reminders. That's how it's meant to be consumed.
- When you catch yourself angry about something outside your control, don't judge the anger. Just notice: "I'm spending energy where it can't help." The noticing IS the practice.
- Stoicism pairs well with other practices. It's not a religion that demands exclusivity. Combine it with therapy, meditation, faith practices, or whatever else serves you.
- The people who look "naturally calm" in a crisis are usually people who have practiced something like this for years. Calm under pressure is a skill, not a personality trait.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill declares an install command using npx clawhub without pinning a specific version or integrity source, which allows whatever package version is current at execution time to run. If the upstream package is compromised or a malicious update is published, users or systems installing the skill could execute attacker-controlled code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The voluntary discomfort section recommends practices like cold exposure, skipping meals, sleeping on the floor, walking in rain, and wearing less than the weather demands, but it does not include concrete health screening, contraindications, or safety warnings. In a wellness/mind skill, users may follow these suggestions literally despite medical conditions, disordered eating history, environmental hazards, or other vulnerabilities, creating a plausible risk of physical harm.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The automation triggers use broad natural-language conditions such as user frustration, anxiety, or a non-null challenge, which can cause the skill to activate in situations where it was not explicitly requested. In a mental-health-adjacent skill, unintended invocation can lead to overbroad advice injection, misrouting of conversations, or inappropriate responses during sensitive contexts.

Content

No source excerpt is available for this finding.