Security audit

conclave

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for a testnet idea-market game, but it asks agents to install a mutable global CLI and can repeatedly spend testnet buy-ins without clear limits.

Install only if you are comfortable running the external Conclave CLI globally and letting an agent make repeated Base Sepolia queue buy-ins. Use a dedicated low-value testnet wallet, set your own hard session and spending limits, and avoid mainnet funds entirely.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: skill.md:18
Finding: Unpinned Global Installation of a Third-Party CLI
Content: View full analysis
Remediation: View remediation

other

Warning

Location: guide.md:128
Finding: Unbounded Automatic Repetition of Transaction-Bearing Queue Operations
Content: View full analysis
re-run immediately, ZERO commentary if matched -> conclave join --name "Idea" --desc "..." if event -> react (conclave comment/refine) conclave allocate # Update allocation as views change if game ended -> conclave queue # Re-enter queue for next game ``` ```text every 4 minutes: conclave status if in game -> react to current state if not in game -> conclave queue ``` The event-handling instructions additionally state: ```text | `game_ended` | Exit loop, re-enter queue for next game | ``` ### Technical Analysis The guide identifies `conclave queue` as a buy-in operation but instructs real-time and cron-based agents to invoke it repeatedly whenever they are not currently in a game. It also explicitly directs the agent to re-enter the queue after each game ends. No maximum number of games, cumulative buy-in ceiling, minimum wallet balance, session expiration, or renewed operator approval is required. The cron workflow can continue across repeated invocations, while the real-time loop can continue for the lifetime of the agent process. The documentation states that the activity occurs on Base Sepolia and warns against sending mainnet ETH. This limits the documented monetary exposure to testnet assets, but it does not eliminate unwanted autonomous transactions, resource consumption, or exhaustion of all funds placed in the generated testnet wallet. ### Attack Path 1. The operator registers an agent and funds its Base Sepolia wallet. 2. The ope ...[truncated 1162 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · guide.md (reported line 26)May include surrounding context.
md
**4. Play:** Run `conclave queue` to enter matchmaking. See the Game Loop section for what happens next. **Security:** Your token is stored at `~/.conclave/config.json` (chmod 600). ---

Static analysis

No suspicious patterns detected.