ClawHub
Back to skill

Security audit

Supernal Coding CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad development CLI reference that is mostly coherent, but it asks users to install an unpinned global package and promotes autonomous or scheduled mutating workflows without enough guardrails.

Review this skill before installing. Prefer pinning the npm package to a reviewed version, avoid running the install with elevated privileges, and treat ralph, git automation, know tidy --fix, know reindex, and cron/heartbeat examples as write operations that should only run in repositories where you have backups and clear approval.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Package Installed Globally

Content
View full analysis
Remediation
View remediation
``` 2. Publish and verify the expected package integrity hash or npm provenance before installation. 3. Link to the package's canonical registry and source repository so users can verify its identity and avoid similarly named packages. 4. Prefer a project-local installation with a committed lockfile over a global installation where operationally possible. 5. Use `npm ci` in automated environments to enforce lockfile-resolved versions and integrity metadata. 6. Review package lifecycle scripts before installation. Where compatible with the package, install with lifecycle scripts disabled: ```bash npm install --ignore-scripts ``` 7. Periodically review and explicitly approve upgrades rather than implicitly installing the latest registry release. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description is extremely broad, covering general development workflows, task management, testing, git automation, compliance, documentation, and autonomous execution. In agentic environments, such broad invocation language can cause over-selection of this skill for many unrelated requests, increasing the chance that automation-capable commands are surfaced or used without adequate user intent confirmation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Task Management (PRIMARY)

bash
sc task create "Title" --assignee @me --priority P2
sc task list                         # Your tasks  
sc task list --all                   # All repos
sc task list --status in-progress    # Filter by status

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation advertises autonomous task execution via 'sc ralph' without any warning about potentially impactful actions such as editing files, running commands, or iterating automatically. In an agent skill, normalizing autonomous execution without constraints can lead to unintended code changes or broader workflow actions being initiated with insufficient oversight.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The examples recommend 'know tidy --fix' and 'know reindex' as routine hygiene operations but do not warn that these commands modify workspace content and metadata. In an automated or agent-driven context, readers may treat them as harmless diagnostics and trigger unintended file changes across the knowledge store.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.