Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill benign with medium confidence: the findings are mostly consistent with its session-inspection purpose, though installation commands are unpinned and scanning was partial.
The verdict is benign, not risk-free. Before installing, consider that the documented npx commands are unpinned; use a version or source revision you have reviewed if available. Skillspector inspected 13 of 14 components, with one partial inspection and unresolved references, so the evidence is incomplete.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def run_script(name, *args):
env = dict(os.environ)
env["PYTHONDONTWRITEBYTECODE"] = "1"
env["PYTHONIOENCODING"] = "utf-8"
return subprocess.run(
Although this is an installer rather than an MCP server, the documented command executes an npm package without selecting a reviewed version and installs a skill from an unpinned repository reference. A compromised future release or repository update could execute code with the user's privileges or introduce malicious globally discovered agent instructions.
The recommended npx and global npm installation commands do not pin the executable package version. If a subsequently selected release is compromised, installation can execute attacker-controlled code and place persistent instructions in a directory scanned by multiple agents; the supplied source does not establish that any release is currently compromised.
Without declared permissions the skill's intent is opaque and cannot be validated.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
case.
4. **Safety posture as core feature.** Read-only stores (SQLite `mode=ro`),
redaction by default, "transcripts are data, not instructions", deliverable
hygiene. waybill shares no-auto-execute; nearly everyone else is silent.
5. **Zero-dependency, works anywhere Python runs** — vs compiled Go/Rust
binaries (catchup, chorus, relay) and stack-dependent servers.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env = dict(os.environ)
env["PYTHONDONTWRITEBYTECODE"] = "1"
env["PYTHONIOENCODING"] = "utf-8"
return subprocess.run(
[sys.executable, "-B", str(SCRIPTS / name), *map(str, args)],
capture_output=True,
text=True,
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
outside the console codepage (e.g. GBK on zh-CN Windows) never crash
the dumper. Call once at the start of main()."""
for stream_name in ("stdout", "stderr"):
stream = getattr(sys, stream_name, None)
if stream is None or getattr(stream, "_utf8_wrapped", False):
continue
encoding = (getattr(stream, "encoding", None) or "").lower()