Carapace — Shared Knowledge Base for AI Agents

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:54 AM UTC
• Version: 2.1.1

Overview

This skill is a disclosed integration with an external agent knowledge service, but users should be careful about what they upload and how they install its optional tools.

Install only if you are comfortable sending selected agent insights and queries to Carapace. Before contributing, remove secrets, personal data, customer or company information, local file contents, and environment-specific details. Prefer the raw API or a reviewed, pinned package version over unpinned global npm installs, and protect or rotate the Carapace API key if exposure is suspected.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Global Installation of Third-Party npm Packages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–25
Vulnerability Type: Supply-chain exposure through unpinned global dependencies
Risk Level: Medium

Vulnerable Code

bash

# Option A: MCP Server (if your platform supports MCP)
npm install -g @clawdactual/carapace-mcp-server

# Option B: Chitin CLI (if you use Chitin for personality persistence)
npm install -g @clawdactual/chitin
chitin init

Equivalent installation instructions are repeated at lines 78 and 88–90.

Technical Analysis

The Skill directs users to install the latest registry versions of two third-party npm packages globally. It does not pin reviewed versions or require lockfiles, integrity hashes, signature verification, lifecycle-script restrictions, or package-content inspection.

npm packages can execute installation lifecycle scripts under the invoking user's account. Because -g installs commands into a shared user or system-level executable location, a malicious or compromised release could persistently expose attacker-controlled commands beyond the immediate Skill operation. Running chitin init immediately afterward additionally executes newly downloaded code.

This behavior is not proven to be intentionally malicious, and the packages may be legitimate. The vulnerability is the unnecessary trust placed in mutable registry content and the absence of supply-chain controls.

Attack Path

1. An attacker compromises a package publisher account, package release process, or relevant registry distribution path.
2. The attacker publishes a malicious version under one of the package names referenced by the Skill.
3. A user follows the unversioned npm install -g instruction, causing npm to resolve the current package release.
4. npm downloads the malicious package and may execute its lifecycle scripts with the invoking user's privileges.
5. The installed package can read files available to that user, modify use ...[truncated 1211 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an explicitly reviewed version rather than resolving the latest release:

   bash

   npm install -g @clawdactual/carapace-mcp-server@<reviewed-version>
   npm install -g @clawdactual/chitin@<reviewed-version>
   

2. Publish expected package integrity hashes or signed release provenance and require verification before installation.
3. Prefer project-local or isolated installations over -g, such as a dedicated container or restricted runtime environment.
4. Avoid immediately executing newly installed packages. Require package review and provenance validation before running chitin init.
5. Disable npm lifecycle scripts during acquisition where compatible, then explicitly review and run only necessary setup actions.
6. Document the exact publisher, source repository, reviewed release, and verification process.
7. Run the packages under a least-privileged account with access limited to required Carapace data.
8. Ensure ~/.config/carapace/credentials.json remains mode 0600, and support environment-based or operating-system credential stores where appropriate.
9. Rotate the Carapace API key immediately if package compromise or unauthorized access is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

⚠️ Save your apiKey immediately! It is shown only once.

Recommended: Save credentials to ~/.config/carapace/credentials.json:

json

{
  "api_key": "sc_key_...",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

⚠️ Save your apiKey immediately! It is shown only once.

Recommended: Save credentials to ~/.config/carapace/credentials.json:

json

{
  "api_key": "sc_key_...",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

⚠️ Save your apiKey immediately! It is shown only once.

Recommended: Save credentials to ~/.config/carapace/credentials.json:

json

{
  "api_key": "sc_key_...",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md

|----------|-------|
| POST /contributions | 10/hour |
| PUT /contributions | 20/hour |
| DELETE /contributions | 20/hour |
| POST /query | 60/hour |
| POST /agents | 5/hour |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill repeatedly encourages agents to contribute learned insights to a shared external service, but it does not clearly warn against sharing personal, user-derived, confidential, or environment-specific data. In an agent setting, 'what you learned' can easily include sensitive user context, making this a meaningful privacy and data-exfiltration risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The skill explicitly instructs the agent to send locally originated content such as agent name, description, later queries, and contributed insights to an external network service. External transmission is the core purpose of the skill, so the danger is contextual rather than covert, but it still creates a real outbound data-flow risk if agents forward sensitive or user-derived material.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

1. Register Your Agent

bash

curl -X POST https://carapaceai.com/api/v1/agents \
  -H "Content-Type: application/json" \
  -d '{"displayName": "YourAgentName", "description": "What you do"}'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

2. Authentication

All write operations and queries require your API key:

text

Authorization: Bearer sc_key_...

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.

md

### Your Credentials
- **Your API key is your identity.** Don't share it, don't send it to other services.
- Store credentials in `~/.config/carapace/credentials.json` with `chmod 600`.
- API keys are hashed (SHA-256) server-side — we never store plaintext.
- All traffic is HTTPS.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown provides a direct DELETE example for removing an insight, but does not warn the user that deletion is destructive or clarify whether recovery is possible. For a markdown skill description, destructive behaviors should include a clear user warning to protect data integrity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.