Tribunal Install

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

This skill appears purpose-aligned, but it tells agents to install and immediately run an unpinned external tool that modifies Claude Code project settings and hooks.

Review the Tribunal package source and version before installing, avoid the one-line install-and-run command in sensitive repositories, prefer a pinned local install where possible, and inspect changes to .claude/settings.json and any generated hooks before using the plugin.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Executable Dependencies and Quality Packs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-38, 67-70, and 74-79
Vulnerability Type: Unpinned third-party executable dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install tribunal
# or
uv add tribunal

bash

npm install -g tribunal

bash

brew install thebotclub/tap/tribunal

bash

pip install tribunal && tribunal init --non-interactive && tribunal doctor

bash

tribunal list-packs          # see available packs
tribunal install python-strict
tribunal install go-tdd
tribunal install nextjs-quality

Technical Analysis

The Skill directs users or agents to install the latest available tribunal package from several external distribution channels without pinning a reviewed version, validating cryptographic hashes or signatures, or using a committed lockfile. The npm variant also installs the package globally.

The quick-install command immediately executes the newly downloaded package. Consequently, installation and execution occur before the user has an opportunity to inspect the resolved version or its dependency graph. The optional quality-pack commands similarly do not document the packs' source, version, integrity metadata, or trust policy.

This creates a supply-chain exposure: if a package publisher account, registry release, Homebrew tap, transitive dependency, or quality-pack distribution channel is compromised, malicious executable content could be delivered through these legitimate-looking commands. The audit found no evidence that the currently referenced Tribunal package or packs are malicious; the vulnerability is the absence of dependency integrity and version controls.

Attack Path

1. An attacker compromises a referenced publisher account, distribution channel, package release, transitive dependency, tap, or quality-pack source.
2. The attacker publishes a malicious version under the exp ...[truncated 1337 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin Tribunal to an explicitly reviewed version in every supported installation example, such as an exact Python or npm package version.
2. For Python installations, use a lockfile or requirements file containing cryptographic hashes and install with hash verification enabled.
3. For npm, use a project-local dependency and committed lockfile rather than a global installation where feasible. Use reproducible installation commands that enforce the lockfile.
4. Pin the Homebrew formula or document a verified release artifact and checksum instead of implicitly accepting the latest tap state.
5. Separate installation from execution. Require verification of the resolved package version, provenance, and integrity before running tribunal init.
6. Document the source, versioning model, signing policy, and integrity-verification procedure for quality packs.
7. Pin quality packs to reviewed immutable versions or content digests if the tool supports this.
8. Run initialization in a least-privileged account or isolated environment, review generated changes to .claude/settings.json, and inspect installed hooks before enabling them.
9. Use trusted registries and enable available package provenance, signature, and publisher-account protections.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description uses broad phrases like 'add quality enforcement' and 'protect this project', which can match many ordinary user requests and cause the skill to activate in contexts the user did not explicitly intend. Because this skill performs installation and project initialization actions, overbroad triggering increases the risk of unnecessary package installation and unintended repository changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to run initialization commands that create .claude/tribunal.json and merge into .claude/settings.json, but it does not prominently warn that project configuration files will be modified. In an agent-driven workflow, this can lead to silent or surprising changes to repository state, especially if the one-liner is executed automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.