Cc Godmode 5.11.3

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.0

Overview

This docs-only skill is not malicious, but it deserves Review because it directs broad autonomous code, file, GitHub, and release actions without consistent approval gates.

Install only if you are comfortable giving an agent broad repository and GitHub authority. Use it in a sandbox or protected branch first, require explicit approval before local writes, PR creation/merge, tags, releases, CI/CD actions, or credentialed GitHub operations, and pin/review any MCP packages before installing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: docs/TROUBLESHOOTING.md:78

Finding

Unpinned Third-Party MCP Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: docs/TROUBLESHOOTING.md:78-90
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash

# In your MCP config (mcp.json)
{
  "playwright": {
    "command": "npx",
    "args": ["playwright-mcp"]
  }
}

bash

npm install -g playwright-mcp
npx playwright install

Technical Analysis

The troubleshooting guide instructs users to install and execute playwright-mcp without specifying an exact, reviewed version or verifying package integrity. The MCP configuration also invokes the package through npx, which can download and execute the version currently available from the configured npm registry when no suitable local installation exists.

This creates a supply-chain risk because the effective executable may change after the Skill package has been audited. A compromised maintainer account, malicious package update, registry compromise, or dependency takeover could cause subsequently retrieved code to execute with the privileges of the user running Claude Code or OpenClaw.

The package is relevant to the Skill's browser-testing functionality, so using a Playwright integration is within the declared scope. However, executing an unpinned package from a mutable external registry exceeds the minimum safe dependency behavior because neither version constraints nor integrity controls are provided.

No evidence establishes that the current playwright-mcp package is malicious. The vulnerability is the unsafe and mutable dependency retrieval process.

Attack Path

1. An attacker compromises the npm package, its publisher account, the configured registry, or a transitive dependency.
2. The attacker publishes a malicious version under the package name referenced by the documentation.
3. A user follows the troubleshooting guide and runs npm install -g playwright-mcp, or configures the MCP server to inv ...[truncated 1223 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to an exact reviewed version, for example:

   bash

   npm install --save-dev playwright-mcp@<reviewed-version>
   

2. Commit and enforce a lockfile so the package and its transitive dependency graph resolve reproducibly.

3. Invoke only the locally installed dependency and prevent automatic registry retrieval:

   bash

   npx --no-install playwright-mcp
   

   Alternatively, reference the executable under node_modules/.bin/ directly.

4. Verify package provenance and integrity before installation. Use a trusted registry, review publisher ownership, inspect lifecycle scripts, and validate registry integrity metadata.

5. Avoid global installation. A project-local development dependency limits unintended cross-project use and makes the selected version auditable.

6. Run the MCP server in a restricted environment with only the project files, network destinations, browser profiles, and credentials required for testing.

7. Document an upgrade process requiring explicit review and testing before changing the pinned version.

8. Clarify that users should not expose production browser sessions, unrestricted credentials, or sensitive environment variables to the MCP process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises autonomous multi-agent implementation, documentation, testing, GitHub operations, and release handling, but it does not place a prominent warning near that section that these workflows may modify codebases, docs, issues, PRs, or CI/CD state. In this context, readers may underestimate the operational impact and authorize the skill in sensitive repositories without understanding that it can drive substantial changes through the host agent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The usage section relies on very broad natural-language triggers such as 'New Feature', 'Bug Fix', and 'Prepare Release' without defining scope limits, confirmation requirements, or non-triggering examples. In a self-orchestrating multi-agent skill, ambiguous trigger boundaries can cause the agent to initiate unintended code, documentation, testing, or release workflows from loosely phrased user input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation guidance is broadly scoped ('analyze the request type' and then select a workflow) rather than constrained to an explicit trigger list, which increases the chance the skill will auto-engage on loosely related prompts. In an orchestration skill with Bash, WebFetch/WebSearch, GitHub, and write capabilities, overbroad triggering can lead to unintended delegation and tool use from ordinary user requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The startup steps instruct the agent to read VERSION, create a reports directory, and later update VERSION and CHANGELOG, but the skill does not clearly present these as potentially automatic local file changes requiring explicit approval first. In practice, this can cause unexpected workspace modifications simply from activation of the skill, especially since the skill also advertises Write/Edit/Bash capabilities and self-orchestration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The description says, "You say WHAT, the AI decides HOW," which is a very broad natural-language activation framing and does not define specific trigger phrases, scope limits, or exclusion conditions. In a manifest file, this can create ambiguity about when the skill should be invoked versus ordinary user requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide tells users to 'try' natural-language commands like 'New Feature: X', 'Bug Fix: X', and 'Prepare Release' as activation patterns, but it does not state where these commands are valid, how exact the phrasing must be, or what should not trigger the skill. Because these are common project-management phrases, the lack of negative examples or invocation boundaries makes unintended activation more likely.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 117)May include surrounding context.

1. Check installed version:

bash

grep "version:" ~/.clawdbot/skills/cc-godmode/SKILL.md

2. Update to latest:

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · docs/TROUBLESHOOTING.md (reported line 51)May include surrounding context.

1. Check installed version:

bash

grep "version:" ~/.clawdbot/skills/cc-godmode/SKILL.md

2. Update to latest:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Release workflow instructs the agent to create a git tag, publish a GitHub release, and trigger CI/CD without an explicit confirmation or warning that these are externally visible, potentially irreversible actions. In a self-orchestrating skill, this increases the chance that a user request like 'Prepare Release' causes unintended publication or deployment before the user understands the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Process Issue workflow says the agent will load a GitHub issue, choose and execute a workflow, and then create a PR with 'Fixes #X' automatically, but it does not disclose this side effect up front or require approval. Because this skill is designed for autonomous orchestration, that omission makes unintended repository reads/writes and code changes materially more likely from a short prompt.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file instructs users to run clawdhub uninstall cc-godmode and then reinstall the skill, which changes the local environment by removing and re-adding the installed skill. The troubleshooting text presents the commands as routine steps but does not warn that they will alter the current installation state or may remove local modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The document tells users to run gh auth login, which initiates credential entry or token-based authentication, but does not disclose that the step involves authentication material. For markdown guidance, this is a user-facing action affecting privacy/security and should be accompanied by a short warning or note.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.