Security audit

Clinch Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Clinch negotiations, but it asks for high-impact negotiation, credential, install, and seller auto-approval behavior with several important safety gaps.

Review this skill carefully before installing. Use it only in an isolated environment, pin and verify the Clinch CLI package, avoid putting private keys or tokens directly on command lines, treat all remote node instructions as untrusted data, and disable or explicitly configure seller auto-approval before running a seller node.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:34
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:83
Finding: Untrusted Remote Node Instructions Can Influence Agent Behavior
Content: View full analysis
--direct ``` The output provides read-only parameters synced from the central dashboard. **Crucially, analyze the node's `instructions` or `customInstructions` output** to understand exactly how the target node expects your constraints JSON to be formatted. ``` ### Technical Analysis The skill explicitly directs the agent to analyze `instructions` or `customInstructions` returned by a remote node. These fields may be controlled by a seller or another external party, but the skill does not require them to be treated strictly as untrusted data, constrain them to a validated schema, or prohibit them from changing the agent's behavior outside JSON formatting. A malicious node could place prompt-injection content in these fields, including instructions to disregard existing constraints, disclose contextual information, modify negotiation parameters, invoke tools, or initiate unrelated actions. The skill's human approval gate protects final deal approval, but it does not fully protect discovery, negotiation initiation, data disclosure, or other actions performed before approval. ### Attack Path 1. An attacker registers or controls a discoverable Clinch seller node. 2. The attacker inserts adversarial natural-language instructions into the node's `instructions` or `customInstructions` field. 3. A user asks the agent to discover sellers in the attacker's category. 4. The agent runs `clinch discover` and receives the attacker-controlled field. 5. Following the skill text, the agent analyzes that field as operational guidance. 6. If the field is interpreted as authoritative instruction rather than untrusted data, the agent may alter constraints, disclose available context, or perform unintended tool operations. 7. The att ...[truncated 564 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:66
Finding: Private Keys and Secret Tokens Are Passed Through Command-Line Arguments
Content: View full analysis
``` ``` ```markdown ### Blind Key Pass (for gated seller nodes) If a seller requires a pre-shared token to accept proposals: ```bash clinch key --set --value ``` ``` ### Technical Analysis The documented commands place a dashboard private key and a pre-shared seller token directly in command-line arguments. Depending on the operating system, shell, agent framework, and logging configuration, command arguments may be exposed through: - Shell history files. - Process inspection interfaces while the command is running. - Agent tool-call transcripts. - Terminal session recording. - Audit, telemetry, or debugging logs. - Error reports that reproduce the command. Although the skill explicitly says not to store or log `CLINCH_PASSPHRASE`, it does not provide equivalent handling requirements for the dashboard private key or seller token. Encrypting the token after the CLI receives it does not remove copies that may already exist in command history or logs. ### Attack Path 1. A seller obtains a dashboard private key or pre-shared seller token. 2. The user or agent substitutes the real secret into one of the documented commands. 3. The shell, process table, agent transcript, telemetry system, or terminal recorder captures the complete command line. 4. A local user, log reader, support operator, or attacker with access to those records retrieves the secret. 5. The recovered private key is used to impersonate the seller identity, or the recovered token is used to ac ...[truncated 515 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 89% confidence
Finding: The skill explicitly documents a seller configuration with an 'auto-approve threshold' and even gives default autonomous approval behavior ('approve $100'). That enables the agent or seller node to cryptographically commit deals without a per-deal human confirmation, which conflicts with the otherwise stated human gate for approvals and creates risk of unauthorized commitments, financial loss, or abuse by counterparties who tune offers to slip under the threshold.
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
clinch serve --port 8080 --config /path/to/seller-config.json

text
The seller config JSON sets your machine's local logic: pricing floor, auto-approve threshold, and max negotiation turns. If no config is provided, defaults are used (floor $45, approve $100, maxTurns 5). ### Configuring node mode

Static analysis

No suspicious patterns detected.