MALP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:22 AM UTC
• Version: 1.0.0

Overview

This skill creates and manages local project context notes, with persistent files and optional git-history reads that are disclosed and aligned with that purpose.

Install this only if you want a persistent local context system. It will create `.malp/` directories in projects you target, maintain maps under `~/.malp-home/`, and may read repository structure or optional git metadata for recommendations. Keep secrets out of `.malp/` notes and decide whether these files should be ignored or committed in each repository.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: malp
description: 'Project context tracker using `.malp/` directories. Use when the user wants to discover existing malps, open a specific `.malp`, create or refresh a malp for a path, or classify, retire, or promote malps between active, attic, and unindexed states. Also use for context-heavy questions that benefit from heuristic scouting, such as choosing the best malp for a task, deciding whether a path should get a malp, surveying what malps exist without fully loading them, or using project-local reconnaissance such as `.clawpatch/` as a conceptual FOB. Triggers include "what malps do we have", "list malps", "show malps", "open a malp", "send malp to a path", "best malp for", and requests to move a malp into or out of the attic. Do not treat generic requests to edit this skill as instructions to create or use a `.malp/` inside the installed skill directory unless the user explicitly asks for that. M*A*L*P stands for M*A*L*P Analyzes Lovely Plumage.'
---

# M*A*L*P

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

1. Resolve this `SKILL.md` directory as `<skill-dir>`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

- `scripts/kino.py` — stdlib-only heuristic scout for candidate-malp recommendation, optional provenance-aware direct-answer reporting, bounded git-history auxi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes file reads and shell execution (python3 <skill-dir>/scripts/kino.py ...) but does not declare an explicit tool scope such as allowed tools or permissions. That increases the chance the runtime grants broader-than-intended capabilities, making it easier for the skill to inspect or modify unintended filesystem locations, especially because it also references user-home state like ~/.malp-home/.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill is designed to create, refresh, classify, retire, and promote .malp/ directories and to update indexes such as ~/.malp-home/MAP.txt and ~/.malp-home/attic/MAP.txt, which is explicit session persistence. While framed as user-requested project metadata, it creates durable state across sessions and repositories; if misused or insufficiently scoped, it could store sensitive context or alter user environment state unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: malp
description: 'Project context tracker using `.malp/` directories. Use when the user wants to discover existing malps, open a specific `.malp`, create or refresh a malp for a path, or classify, retire, or promote malps between active, attic, and unindexed states. Also use for context-heavy questions that benefit from heuristic scouting, such as choosing the best malp for a task, deciding whether a path should get a malp, surveying what malps exist without fully loading them, or using project-local reconnaissance such as `.clawpatch/` as a conceptual FOB. Triggers include "what malps do we have", "list malps", "show malps", "open a malp", "send malp to a path", "best malp for", and requests to move a malp into or out of the attic. Do not treat generic requests to edit this skill as instructions to create or use a `.malp/` inside the installed skill directory unless the user explicitly asks for that. M*A*L*P stands for M*A*L*P Analyzes Lovely Plumage.'
---

# M*A*L*P

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

- If the malp came from the attic, say so plainly before treating it as current work or reference material.
- Distinguish between opening a malp as the current worksite, opening it only as reference material, and invoking Kino as heuristic reconnaissance.
- Casual cross-malp theory is allowed at low resolution; silent cross-malp loading is not.
- Do not read, summarize, or otherwise bring another `.malp` into active context without asking first, even if a cross-reference suggests it may help, unless Kino is warranted by the question.
- During Kino, traversal may widen substantially if needed, but the answer should normally collapse back down to a recommendation about what malp to load next, if any, plus the confidence of that recommendation.
- A recommended malp may be relevant because of its project territory even when its own notes never recorded the pattern explicitly.
- When Kino recommends a malp, say whether the promotion should be reference context or working context.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/tasks.md (reported line 360)May include surrounding context.

md

- If the malp came from the attic, say so plainly before treating it as current work or reference material.
- Distinguish between opening a malp as the current worksite, opening it only as reference material, and invoking Kino as heuristic reconnaissance.
- Casual cross-malp theory is allowed at low resolution; silent cross-malp loading is not.
- Do not read, summarize, or otherwise bring another `.malp` into active context without asking first, even if a cross-reference suggests it may help, unless Kino is warranted by the question.
- During Kino, traversal may widen substantially if needed, but the answer should normally collapse back down to a recommendation about what malp to load next, if any, plus the confidence of that recommendation.
- A recommended malp may be relevant because of its project territory even when its own notes never recorded the pattern explicitly.
- When Kino recommends a malp, say whether the promotion should be reference context or working context.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/attic.md (reported line 45)May include surrounding context.

md

Keep the original project-local malp in place, remove it from the active `MAP.txt`, and add its path to `~/.malp-home/attic/MAP.txt`.

Optionally create a small metadata note alongside it that records:
- original path
- attic date
- short reason

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs the agent to persist investigation details, reachability judgments, and related findings into project-local .malp/ files. That creates a session-persistence risk because sensitive security analysis context, internal assessments, or operational notes may be stored on disk and retained across sessions without clear minimization or user confirmation, increasing exposure if the repository is shared or committed.

Content

Scanner excerpt · references/tasks.md (reported line 67)May include surrounding context.

md

In repo `.malp/` files, record only what is local to the project:
- active finding IDs and short titles
- current reachability / plausibility-to-recreate judgments
- whether the finding is ordinary-browser reachable, direct-route/API-only, endpoint-owner-unclear, dead-code risk, or unresolved semantic risk
- next verification front

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script can mine repository history to identify authors, commit subjects, and introduction timing for terms found in MALP-related queries. That expands the skill from local context tracking into metadata reconnaissance, which can reveal contributor identities and historical project information without being necessary for basic MALP discovery.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/kino.py (reported line 439)May include surrounding context.

python

"--pretty=format:%ad\t%an\t%h\t%s", f"-S{variant}", "--", ".",
        ]
        try:
            proc = subprocess.run(cmd, capture_output=True, text=True, check=False)
        except Exception:
            continue
        if proc.returncode != 0 or not proc.stdout.strip():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/kino.py (reported line 550)May include surrounding context.

python

"--pretty=format:%ad\t%an\t%h\t%s", f"-S{variant}", "--", ".",
        ]
        try:
            proc = subprocess.run(cmd, capture_output=True, text=True, check=False)
        except Exception:
            continue
        if proc.returncode != 0 or not proc.stdout.strip():

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The freshness feature inspects repository commit recency and dirty state for a recommended territory, exposing development activity and uncommitted-change metadata unrelated to simple MALP management. In a shared or sensitive workspace, this can leak operational details about code churn and local modifications to users who only asked for context selection.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default prompt says to use "$malp" to find the best project context for "this task," but it does not define the trigger scope, constraints, or situations where the skill should not be invoked. That broad phrasing could overlap with many routine tasks and may cause unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file instructs the skill to create a .malp directory, write SUMMARY.txt, refresh FOB.txt, remove items from NOTES.txt, and update ~/.malp-home/MAP.txt. These are user-data and filesystem-modifying behaviors, but this section does not explicitly warn the user that invoking the command will create and alter files on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

When Git-history probing is enabled, the script can emit author, commit, date, and subject information without any built-in warning or consent prompt in the output path. This creates a transparency/privacy issue because repository metadata is surfaced to the caller implicitly rather than with clear notice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.