Tribunal Usage

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only Tribunal usage skill whose higher-risk hook, audit-log, and plugin-pack behaviors are disclosed and aligned with quality-gate enforcement.

Before installing or using Tribunal, review the package and any plugin packs, prefer pinned versions or trusted sources, and keep .tribunal audit logs out of source control if file paths, agent IDs, or operational details are sensitive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Dependency and Unverified Plugin Pack Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20 and SKILL.md:95-100
Vulnerability Type: Supply-chain exposure through unpinned packages and arbitrary plugin sources
Risk Level: Medium

Vulnerable documentation snippets:

markdown

Tribunal is a Claude Code quality enforcement plugin. Once installed (`pip install tribunal && tribunal init`), it hooks into every file write, test run, and agent interaction.

bash

tribunal list-packs                    # browse registry
tribunal install python-strict         # 90% coverage, type hints, docstrings
tribunal install go-tdd                # go test -cover, go vet, -race flag
tribunal install nextjs-quality        # TypeScript strict, component tests, a11y
tribunal install https://github.com/org/custom-pack   # direct URL
tribunal install ./local-pack/         # local directory

Technical Analysis

The Skill recommends installing tribunal from PyPI without pinning a version or validating an integrity hash. It also documents installation of plugin packs directly from arbitrary GitHub URLs and local directories without requiring a trusted-source allowlist, immutable commit reference, signature verification, checksum validation, or source review.

This creates a supply-chain trust gap: the code ultimately installed can differ from the code previously reviewed. The exposure is particularly significant because the initialized dependency is described as intercepting file writes, Bash-related test activity, and agent lifecycle events. A malicious or compromised distribution could therefore execute in a security-sensitive development context.

The project itself contains only documentation and does not ship a malicious executable payload. Exploitation depends on compromise or malicious control of an external package or pack source.

Attack Path

1. An attacker compromises a Tribunal package release, a plugin-pack repository, or ano ...[truncated 1230 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin Tribunal to a reviewed, trusted version, for example by using an exact version constraint rather than an unconstrained pip install tribunal.
2. Require package hashes through a locked requirements file and install with hash verification, such as pip's --require-hashes workflow.
3. Prefer signed releases and document how users must verify signatures or checksums before installation.
4. Restrict plugin packs to an explicit allowlist of reviewed publishers and repositories.
5. For Git-based packs, require an immutable reviewed commit SHA rather than a mutable branch or generic repository URL.
6. Require manual source review for local and remote packs before installation, including examination of installation scripts, hooks, and subprocess execution.
7. Install and test packages in an isolated virtual environment or container with minimal filesystem access and no unnecessary credentials.
8. Document the lifecycle hooks and permissions enabled by tribunal init, and require explicit user confirmation before enabling them.
9. Maintain a dependency lockfile and periodically audit pinned dependencies and plugin packs for newly disclosed vulnerabilities or ownership changes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says to use the skill for 'running quality checks,' 'configuring enforcement modes,' and 'working with multi-agent Claude Code workflows,' which are broad scenarios rather than specific trigger phrases or constrained invocation conditions. Because it does not provide exclusion conditions or narrower scope, this could cause unintended invocation in ordinary coding contexts where many tools might apply.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill states that hook events are automatically logged and later explicitly documents .tribunal/audit.jsonl, but it does not warn that persisted audit data may include sensitive metadata such as file paths, agent identifiers, outcomes, and operational details. In a development environment with secrets scanning, multi-agent workflows, and CI hooks, silent persistence increases the risk of retaining or exposing sensitive activity data to other users, tools, or source control.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.