Security audit

Factory Floor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its startup-coaching purpose, but its installer automatically runs an unpinned npm dependency install that creates avoidable supply-chain execution risk.

Review this before installing with npx. The coaching instructions themselves look purpose-aligned, but the installer performs an automatic npm dependency install for diagram rendering. Prefer installing through a controlled ClawHub flow, pin the package version if using npx, and treat the diagram renderer dependency as third-party code that may run during setup.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: bin/install.mjs:50
Finding: Unpinned Runtime Dependency Installed with Lifecycle Scripts Enabled
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README explicitly states that simply describing a problem can activate the skill implicitly. This broad, natural-language trigger model is risky because it enables accidental invocation from common text, making it easier for unrelated conversations or adversarial content to route into the skill and influence agent behavior without deliberate user consent.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · stages/growth.md (reported line 345)May include surrounding context.
md
Most constraint work has a feedback delay. A content strategy takes 4-8 weeks to show up in acquisition. An onboarding improvement takes 2-3 cohorts to show up in activation. Set a minimum evaluation window (usually one GOLEAN cycle) and don't judge results before it closes. ### Estimate time honestly

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 15)May include surrounding context.
npx @swiftner/factory-floor

text
Installs to `~/.claude/skills/factory-floor/`. Triggers automatically when you talk about priorities, bottlenecks, what to build, or why growth is flat. ### OpenAI Codex

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README says the skill triggers automatically when users talk about broad topics like priorities, bottlenecks, or growth. Overly broad implicit activation can cause the skill to engage unexpectedly in ordinary conversations, increasing the chance of unintended prompt injection surface, context capture, or interference with other tasks.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 23)May include surrounding context.
npx @swiftner/factory-floor

text
Installs to `~/.codex/skills/factory-floor/`. Codex picks it up automatically — trigger with `/skills` or `$` to mention it directly, or just describe your problem and it will activate implicitly. Or install via ClawHub:

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The analyzer content is materially inconsistent with the skill manifest: the skill is advertised as a startup coaching assistant, but the file defines a benchmark-results interpreter for evaluation analysis. This creates a skill-definition integrity issue where the wrong behavior may be invoked, leading to misleading outputs, policy bypass of intended scope, and erosion of operator trust in what the skill actually does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installer writes multiple files into ~/.claude/skills/factory-floor automatically without prompting the user or offering a dry-run/review step. Although the target path is skill-related, silent modification of a user's home directory reduces transparency, can overwrite existing local content, and is risky in tooling that users may execute with broad trust.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installer runs npm install --silent inside a copied scripts directory, which executes arbitrary package lifecycle scripts from that directory's dependency tree. For a startup coaching skill, network dependency installation is not intrinsic to the stated purpose, so this expands the attack surface significantly and could lead to arbitrary code execution during install if dependencies are compromised or the package contents are tampered with.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installer executes a shell command without any prior warning or confirmation, causing immediate command execution on the user's machine during installation. Because this is a non-essential behavior for a coaching skill and the command invokes package installation, it creates unexpected code-execution and supply-chain risk that users may not anticipate from the skill description.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The phrase "Load this when you need deeper diagnostic questions or coaching guidance" is a vague trigger for a markdown skill because it uses broad everyday language without clear scope, constraints, or exclusion conditions. This can overlap with many general coaching or advice situations and does not specify when this pattern should or should not be used.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The phrase 'Load this when the founder's framing seems wrong' is an ambiguous trigger for a markdown skill because 'seems wrong' is subjective and does not define clear boundaries for when the skill should or should not activate. The description also lacks explicit trigger examples or exclusion conditions, increasing the risk of overbroad invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file explicitly says to load this content when a founder asks for a weekly review or check-in, which is relatively broad trigger language and can cause the skill to activate in situations that only loosely match the user's intent. While this is not directly malicious and the content itself is low-risk coaching guidance, overbroad invocation can lead to unintended routing, irrelevant guidance, and reduced trust in agent behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly advises founders to track signups, activation, conversion, churn, and later mine support tickets, churn conversations, and lost-deal notes, but provides no caution about collecting only necessary data, avoiding sensitive personal data, or complying with privacy obligations. In a business-operations skill, this omission can normalize broad customer-data collection and reuse in ways that expose personal or confidential information, especially when founders use ad hoc spreadsheets or lightweight tooling.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is specified with a caret range (^1.1.3), which allows newer compatible versions to be installed without explicit review. This weakens supply-chain reproducibility and can introduce vulnerable or malicious updates unexpectedly, especially in automated installs or CI environments.
Content: Scanner excerpt · scripts/package.json (reported line 6)May include surrounding context.
json
"private": true, "type": "module", "dependencies": { "beautiful-mermaid": "^1.1.3" } }

Unverifiable Dependency: beautiful-mermaid has 1 known advisory(ies) (CVE-2026-26226 (beautiful-mermaid contains an SVG attribute injection issue that can lead to cro)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The manifest references beautiful-mermaid without pinning an exact version, while the package has a known advisory involving SVG attribute injection that may lead to cross-site scripting-like behavior when rendered in downstream consumers. Because the allowed version range is broad enough to make the installed version uncertain from the manifest alone, the project may resolve to an affected release and expose users or developers who process untrusted diagram content.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/install.mjs:53