Ideonomy Engine — Creative Reasoning for AI Agents

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:29 AM UTC
• Version: 0.3.4

Overview

This looks like a normal reasoning helper, but it depends on a globally installed, unpinned third-party npm CLI whose code is not included for review.

Review the npm package and publisher before installing. Prefer a pinned version matching the skill metadata, a project-local install, and inspection of package contents and lifecycle scripts before running the CLI in an environment with sensitive files or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-17
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npm install -g @clawdactual/ideonomy-engine

Verify with:

bash

ideonomy --help

text

### Technical Analysis

The installation instructions retrieve the latest available version of `@clawdactual/ideonomy-engine` from the npm registry and install it globally. No exact version, lockfile, integrity hash, package provenance check, or source review requirement is provided.

Because the audited project contains only `SKILL.md`, the installed npm package supplies all executable behavior associated with the Skill, but its implementation is not included in the auditable artifact. The effective code can therefore change after this Skill has been reviewed.

npm packages can define lifecycle scripts that execute during installation. If the package publisher account, registry distribution channel, or a future release is compromised, following this instruction could execute attacker-controlled code with the privileges of the user running npm. Global installation also places the CLI in a broadly accessible executable location, increasing the scope and persistence of an affected installation compared with a project-local dependency.

This finding does not establish that the named package is currently malicious. The risk arises from the mutable, unverified, globally installed dependency.

### Attack Path

1. An attacker compromises the package publisher account, release process, or another component of the npm supply chain.
2. The attacker publishes a malicious version under the existing package name.
3. A user follows `SKILL.md` and executes `npm install -g @clawdactual/ideonomy-engine`.
4. npm resolves the command to the latest mutable package version rather than a previously reviewed version.

...[truncated 963 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version, for example:

   bash

   npm install --global @clawdactual/ideonomy-engine@0.3.4
   

   Do not use version ranges or implicit latest-version resolution.
2. Prefer a project-local installation with a committed lockfile over global installation:

   bash

   npm install --save-exact @clawdactual/ideonomy-engine@0.3.4
   npx ideonomy --help
   

3. Publish and verify package provenance, checksums, signatures, and the expected npm registry source before installation.
4. Review the resolved package contents, transitive dependencies, and lifecycle scripts before recommending the package.
5. Where lifecycle scripts are not required, install with --ignore-scripts and document any resulting functionality limitations.
6. Execute the tool with least privilege in a restricted environment that does not expose credentials or sensitive files.
7. Include the executable implementation or a reproducibly verifiable source reference in the audited artifact so its actual behavior can be reviewed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s activation description is overly broad and matches common requests like brainstorming, getting unstuck, or exploring perspectives. That can cause the skill to trigger in many ordinary conversations, unnecessarily expanding its influence over agent behavior and increasing the chance it is invoked in contexts where its guidance is irrelevant, misleading, or can interfere with safer/specialized skills.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.