Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent, but it directs users to run mutable npm code that reads local Claude Code and Codex transcripts and can optionally install persistent agent-control hooks.
Review this carefully before installing or running. The skill's purpose is legitimate and disclosed, but use it only if you trust the npm package and plugin source, and avoid running it in workspaces where local agent transcripts may contain secrets unless you have validated the package version or use a pinned/trusted install path.
The manifest-level description references npx agentguard-burn why without a version pin, signaling that the skill's intended execution model is live retrieval and execution from npm. As a skill artifact, this is more dangerous than a generic doc snippet because assistants may surface and encourage the exact command automatically, amplifying supply-chain risk.
The skill instructs use of npx agentguard-burn why without pinning an exact package version or integrity, which causes code to be fetched and executed from npm at runtime. If the package is compromised, republished maliciously, or resolved to an unexpected version, arbitrary code could run on the user's machine while this tool also has access to local Claude Code/Codex transcripts.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The primary usage instruction tells the operator to run npx agentguard-burn why, which performs remote package resolution and code execution without version pinning. In this context the tool reads local transcripts, so a compromised package could exfiltrate sensitive session history or execute arbitrary local actions.
This line again directs users to execute an unpinned npm package, allowing whatever version npm resolves at that moment to run locally. Because the skill specifically targets local transcript analysis, the blast radius includes potentially sensitive developer conversations, prompts, paths, and tool outputs.
Suggesting ! npx agentguard-burn why inside Claude Code still results in unpinned remote code execution from npm. Embedding the command in an assistant skill increases the chance users will run it with little scrutiny, which makes supply-chain compromise more dangerous.
This duplicate finding corresponds to the second unpinned command on the same line (enforce). It carries the same supply-chain risk: executing mutable npm content locally without version control.
The calendar command is another unpinned runtime fetch-and-execute path from npm. Even though its functional purpose is reporting token history, the security issue is the same arbitrary code execution risk from a mutable external package.
The compare command repeats the same unsafe pattern of unpinned npx execution. Any compromise of the package or dependency chain could run attacker-controlled code on the local machine.
The rewrites command is another instance of unversioned remote package execution. The skill context makes this more sensitive because the tool operates over local developer transcripts and metadata that may contain secrets or proprietary information.
The quiet on/off examples continue the same pattern of executing an unpinned npm package via npx. Repetition throughout the skill normalizes the unsafe practice and increases the likelihood of users executing mutable code from the registry.
No suspicious patterns detected.
