Self Improving Intent Security Agent

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.7

Overview

This is mostly a local documentation and template skill, but its docs overstate security protections and include unsafe installation/publishing guidance that users should review carefully.

Use this as templates and local workflow scaffolding, not as a standalone security control. Review the shell scripts before running, pin and verify any npx or GitHub Action installation/publishing paths, confirm the repository owner, and do not enable hooks, automatic rollback, or persistent learning promotion without a tested host runtime and explicit approval gates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:63

Finding

Mutable Third-Party GitHub Action Is Granted a Publishing Secret

Content

View full analysis

Vulnerability Details

File Location: README.md:63-71
Vulnerability Type: Supply-chain exposure through a mutable GitHub Action reference
Risk Level: Medium

Vulnerable Code

yaml

## 🚀 Publish Your Own Skills

Want to publish your Claude Code skills to Clawhub? Use our dedicated GitHub Action:

- uses: nishantapatil3/clawhub-publish-action@v1
  with:
    clawhub-token: ${{ secrets.CLAWHUB_TOKEN }}

Technical Analysis

The documentation recommends running nishantapatil3/clawhub-publish-action using the mutable v1 tag while granting that action access to CLAWHUB_TOKEN. A Git tag is not an immutable integrity boundary: the repository owner or an attacker who compromises the action repository can move or replace the tag so that future workflow runs execute different code from the code originally reviewed.

This behavior is not part of the local intent-documentation functionality declared by the Skill. It is publishing guidance, but it places a sensitive publishing credential into a remotely maintained component without pinning the component to a verified commit.

No evidence shows that the currently referenced action is malicious, and the action is presented as an optional example rather than included as an active workflow. The vulnerability is the unsafe trust model users are instructed to adopt.

Attack Path

1. A user copies the recommended workflow into a repository and configures CLAWHUB_TOKEN.
2. The referenced action repository or its maintainer account is compromised, or the mutable v1 tag is intentionally moved.
3. The attacker publishes modified action code under the same v1 reference.
4. A push, release, or manually triggered workflow executes the modified action.
5. The malicious action reads the supplied clawhub-token input and may transmit it to an attacker-controlled endpoint.
6. The attacker uses the stolen token to publish, replace, or tamper with packages ...[truncated 615 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the action to a reviewed full commit SHA instead of @v1:

  yaml

  - uses: nishantapatil3/clawhub-publish-action@FULL_40_CHARACTER_COMMIT_SHA
    with:
      clawhub-token: ${{ secrets.CLAWHUB_TOKEN }}
  

• Record the corresponding release version in a comment so automated dependency tools can still identify updates.

• Use a narrowly scoped, short-lived publishing token where supported.

• Restrict publishing to protected environments with required reviewer approval.

• Set explicit minimal workflow permissions, such as contents: read, unless broader access is demonstrably required.

• Review action source changes before updating the pinned SHA.

• Prefer registry publication through an official, provenance-enabled workflow or GitHub trusted publishing if supported, eliminating long-lived publishing secrets.

T08 · Insecure Dependencies

Warning

• Location: docs/guide/quick-start.md:23

Finding

Inconsistent and Unpinned Remote Skill Installation References

Content

View full analysis

Vulnerability Details

File Location: docs/guide/quick-start.md:23-37
Vulnerability Type: Unsafe remote package and repository identity resolution
Risk Level: Medium

Vulnerable Code

bash

### Option 1: NPM Package (Recommended)

```bash
# Install skill
npx skills add nispatil/self-improving-intent-security-agent

Option 2: Clone Repository

bash

# Clone repository
git clone https://github.com/nispatil/self-improving-intent-security-agent.git
cd self-improving-intent-security-agent

# Run setup script
./scripts/setup.sh

text

The canonical project metadata elsewhere identifies the owner as `nishantapatil3`, including `package.json:19-21`, `SKILL.md:11`, and `README.md:84`. The quick-start guide instead installs or clones from `nispatil`.

### Technical Analysis

The installation instructions combine two supply-chain weaknesses:

1. They identify a repository owner that differs from the canonical owner in the package metadata.
2. The `npx skills add` command does not pin a release tag, version, or immutable commit.

As a result, users following this guide may retrieve content from a different namespace or may execute a future version that was not part of this audit. If the alternate namespace is attacker-controlled, becomes attacker-controlled, or resolves differently through the installer, the effective Skill instructions and scripts can be replaced.

The audited package itself has no runtime dependencies, install lifecycle scripts, encoded payloads, network-capable shell commands, SSH-key changes, services, or scheduled persistence. The risk occurs before the audited local scripts run, at remote source resolution.

### Attack Path

1. A user follows `docs/guide/quick-start.md` and invokes the installation or clone command using the `nispatil` owner.
2. The remote namespace resolves to a repository or package source not controlled by the canonical `nishantapatil3` proj
...[truncated 1314 chars]

Remediation

View remediation

Remediation Suggestions

• Replace every nispatil reference with the verified canonical owner, nishantapatil3, after confirming repository ownership.

• Pin installation examples to a reviewed release or immutable commit, for example:

  bash

  npx skills add nishantapatil3/self-improving-intent-security-agent@1.0.7
  

  or, if supported:

  bash

  npx skills add nishantapatil3/self-improving-intent-security-agent#FULL_COMMIT_SHA
  

• For Git installation, use a verified tag or commit and validate the checked-out revision before running scripts.

• Publish checksums or signed release provenance and document how users can verify them.

• Add CI checks that reject inconsistent owner names and unpinned installation references across Markdown files.

• Avoid describing npx installation as recommended unless the exact package source, version resolution, and integrity guarantees are clearly documented.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (47)

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · DEVELOPMENT_CONTEXT.md (reported line 142)May include surrounding context.

md

### 5. **Bounded Learning**
- Can learn: Strategies, patterns, optimizations
- Cannot learn: Bypass security, expand permissions, violate constraints
- Safety: Complexity limits, performance constraints, approval gates

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PUBLISHING.md (reported line 42)May include surrounding context.

md

To get an npm token:
1. Create account at https://npmjs.com
2. Go to Account > Access Tokens
3. Generate new "Automation" token
4. Add to GitHub secrets

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 632)May include surrounding context.

md

- [Architecture](references/architecture.md) - System design and components

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 633)May include surrounding context.

md

- [Intent Security](references/intent-security.md) - Validation and authorization

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · docs/demo/walkthrough.md (reported line 583)May include surrounding context.

md

4. **Approve High-Risk Actions** (Demo 4)
   - Human oversight for critical operations
   - Clear context for decisions
   - Always have rollback ready

5. **Monitor Closely** (Demo 5)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · package.json (reported line 96)May include surrounding context.

json

},
      "notes": {
        "security": "All environment variables are optional configuration. No credentials are required or transmitted. All data stays in local .agent/ directory.",
        "privacy": "This skill does not send data to external services. All logs and learnings are stored locally."
      }
    },
    "install": {

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The troubleshooting step rm ~/.clawhub/config is a destructive filesystem command presented as a quick fix. Even if narrow in scope, documentation that instructs users to delete config files can lead to unintended loss of settings, tokens, or other local state, especially if copied blindly or adapted incorrectly.

Content

Scanner excerpt · references/deployment.md (reported line 400)May include surrounding context.

Issue: Authentication failed

bash

# Clear token and re-authenticate
rm ~/.clawhub/config
clawhub login

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/self-improvement.md (reported line 476)May include surrounding context.

md

### 1. Let It Learn
- Requires sample size (10+ observations)
- Don't judge too early
- Give time to converge

### 2. Monitor Closely

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · references/self-improvement.md (reported line 517)May include surrounding context.

md

**Solution**: Always run safety validation, reject if fails

### Learning Harmful Patterns
**Problem**: Learning to bypass security checks

**Solution**: Core security logic is immutable, cannot be modified through learning

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/self-improvement.md (reported line 517)May include surrounding context.

md

**Solution**: Always run safety validation, reject if fails

### Learning Harmful Patterns
**Problem**: Learning to bypass security checks

**Solution**: Core security logic is immutable, cannot be modified through learning

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CLAUDE.md (reported line 326)May include surrounding context.

md

2. Deep dives in `references/`
3. Practical examples in `examples/`
4. Keep README.md synchronized
5. GitHub Pages auto-deploys from `main`

## Safety Principles

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CLAUDE.md (reported line 340)May include surrounding context.

md

### Never Do
- Skip intent validation
- Bypass approval gates for high-risk operations
- Modify safety guardrails without explicit user consent
- Learn patterns that violate constraints
- Execute without audit logging

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document includes concrete commands to create a public GitHub repository and publish the skill externally, but does not warn the user that these actions disclose project contents and may expose sensitive files, local config, or incomplete security-reviewed material. In an agent-skill context, operational instructions can be executed with little scrutiny, so omission of a clear publication warning increases the risk of accidental data exposure or premature release.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The guide tells users to create and configure long-lived publishing tokens but does not include basic warnings about least privilege, storage, rotation, or avoiding disclosure. That omission increases the chance maintainers will handle secrets unsafely, especially in CI/CD environments where copied examples are often followed verbatim.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The publishing guide instructs users to execute npx clawhub without pinning a version, which can fetch and run whatever package version is current at execution time. That creates a supply-chain risk: a malicious or compromised upstream release could be executed in CI or on a maintainer workstation during publishing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example pipes a raw token through shell input to a login command without any warning about exposure risks. Shell history, process inspection, logs, CI output, or accidental copy/paste mistakes can reveal the credential, and because this is a publishing token the resulting compromise could allow unauthorized releases.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The example uses npx clawhub login without a pinned version, so the command may download and execute an unexpected upstream package version at runtime. Because this step is part of an authentication flow, a compromised package could capture or misuse publishing credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

The interactive login example again relies on npx clawhub with no version pinning, exposing users to arbitrary code execution from a future or compromised release. In the context of a publishing workflow, that risk is more significant because the tool may receive tokens or repository access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The publish step uses npx clawhub publish . without constraining the package version, which can execute unreviewed upstream code during a release process. If the package is hijacked or updated maliciously, it could alter artifacts, exfiltrate secrets, or tamper with the published release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

The installation verification step runs npx skills add ... without pinning the skills package version, creating the same time-of-use supply-chain exposure. Anyone following the docs may execute a changed upstream package version with local user privileges.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README first states that the package does not provide runtime enforcement, sandboxing, or autonomous rollback, but later presents architecture, components, and safety guarantees in a way that can reasonably lead users to believe those protections are implemented. This documentation inconsistency can create dangerous overtrust, causing operators to deploy the skill in higher-risk contexts under false assumptions about its actual security capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README instructs users to execute npx skills add ... without pinning a specific package version. This can cause users to fetch and run whatever version of the skills package is current at execution time, increasing supply-chain risk if a malicious or compromised release is published. In the context of a security-focused skill, normalizing unpinned execution makes the issue more concerning because readers may trust the guidance and run it with reduced scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command uses npx skills add ... without any version pinning or integrity constraint, which can pull whatever package version is current at execution time. That creates a supply-chain risk where users may install unexpected or compromised content, especially because npx resolves and executes remote packages dynamically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation first narrows scope by saying the skill does not provide automatic enforcement, anomaly detection, rollback execution, or learning application, but later sections describe automatic hooks and automatic rollback as if they are available. This contradiction can mislead users into trusting controls that may not actually exist or, conversely, enabling automation they did not expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The rollback section states that rollback happens automatically, despite earlier text saying rollback execution must be implemented by the host system. For a security-oriented skill, overstating automated recovery is dangerous because users may rely on nonexistent safeguards during destructive operations, increasing the chance of data loss or unsafe deployment behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.