FargoRate

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:58 AM UTC
• Version: 0.4.1

Overview

The skill is mostly clear and purpose-aligned, but it installs an unpinned external Fargo CLI from a personal Homebrew tap and can persist or print locally added contact data.

Review the Homebrew tap and fargo executable provenance before installing, preferably pinning or otherwise verifying the dependency. Use --db only when you need tracking, keep the database file in a private location, and avoid adding contact details if command output may be logged, shared, or sent through bots.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Executable Dependency from a Personal Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-18
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The skill delegates its functionality to an externally installed fargo executable obtained from a personal Homebrew tap:

yaml

metadata:
  openclaw:
    emoji: "🎱"
    homepage: https://github.com/rgstephens/fargo-skill
    requires:
      bins:
        - fargo
    install:
      - kind: brew
        tap: rgstephens/fargo
        formula: fargo
        bins:
          - fargo

Technical Analysis

The audited project contains only SKILL.md; it does not include the source code for the required fargo executable. The installation declaration references a mutable formula in the personal Homebrew tap rgstephens/fargo without specifying an immutable commit, exact artifact version, cryptographic checksum, or signature.

This creates a supply-chain trust boundary that cannot be validated from the reviewed package. The declaration is not proof that the current dependency is malicious, but compromise or unauthorized modification of the tap, formula, release artifact, or maintainer account could cause users to install attacker-controlled code. Homebrew formula installation may execute formula-defined build or installation logic, and the installed executable subsequently runs with the invoking user's permissions.

Attack Path

1. An attacker compromises the external Homebrew tap, its maintainer account, the referenced release infrastructure, or another dependency in its distribution chain.
2. The attacker modifies the fargo formula or its downloaded artifact to contain malicious installation logic or an altered executable.
3. A user or agent installs or upgrades the dependency according to the skill metadata.
4. Homebrew executes the compromised installation logic or installs the modified binary.
5. The skill later invokes the apparently legitimate `fargo ...[truncated 683 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the CLI's auditable source code in the reviewed project or reference a trusted package registry with transparent provenance.
2. Pin the dependency to an immutable version and source commit rather than a mutable formula reference.
3. Pin and verify a cryptographic checksum for the exact release artifact before installation.
4. Publish and validate signed releases using a documented signature-verification process.
5. Lock transitive dependencies and retain reproducible build metadata or software-bill-of-materials information.
6. Run the CLI with least privilege in a restricted environment, exposing only required files and network destinations.
7. Review dependency changes before upgrades and use automated provenance, checksum, and vulnerability checks in the release process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly documents persistent local storage of player records and optional contact fields in SQLite, but does not clearly warn users about privacy, retention, or access-control implications. Because this data persists across runs and may include user-added personal contact details, operators may unintentionally accumulate sensitive information without realizing it.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented --changes behavior includes locally stored contact fields in normal output and JSON responses when ratings change, which can expose personal data beyond the minimum needed for the FargoRate use case. In shared terminals, logs, bot transcripts, or downstream JSON consumers, this creates an unnecessary data-leakage path for email, mobile, Telegram, or Discord details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The markdown includes a delete operation for named groups, but does not explicitly warn that this command deletes persisted local group membership data. For markdown files, destructive behaviors affecting stored user data should be accompanied by a user-facing warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.