Mission Claw

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:41 PM UTC
• Version: 0.1.2

Overview

This skill is a coherent local activity-logging helper, but users should understand it can record task and project metadata plus token counts through a globally installed CLI.

Install only if you want agent activity, project names, task descriptions, and token usage recorded in Mission Claw. Review or pin the npm package before global installation, and avoid logging sensitive task details unless you explicitly intend to store them locally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 6 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ```yaml install: npm install -g mission-claw ``` ### Technical Analysis The skill directs users to install the latest available version of the third-party `mission-claw` npm package globally. The command does not pin a reviewed version or verify package integrity. Because npm packages may define lifecycle scripts that execute during installation, a compromised package release or publishing account could cause attacker-controlled code to run. The `-g` option installs the package into the user's global npm environment, increasing the scope beyond this project and making the resulting executable available system-wide for that user. The audit found no evidence that the currently documented package is malicious. The vulnerability is the unsafe dependency acquisition method and its exposure to supply-chain compromise. ### Attack Path 1. An attacker compromises the `mission-claw` package, its publisher account, or its release process. 2. The attacker publishes a malicious version as the package's latest release. 3. A user follows the documented `npm install -g mission-claw` instruction. 4. npm retrieves the unreviewed latest version and runs any applicable installation lifecycle scripts. 5. Attacker-controlled code executes with the installing user's privileges, and a malicious `mclaw` executable may be placed in the user's global command path. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user running npm. The attacker could access or modify resources available to that account, tamper with globally installed tooling, or replace the expected `mclaw` command with malicious behavior. Administrative impact would be possible if the installation were run with elevated privileges, although the documentation does not instruct users to do so.
• Remediation: ## Remediation Suggestions - Pin the dependency to a specifically reviewed version rather than installing the latest release implicitly. - Verify the package's provenance and integrity against a trusted digest or registry integrity value. - Prefer a project-local installation governed by a committed lockfile instead of global installation. - Review package contents and lifecycle scripts before installation. - Use `--ignore-scripts` where package functionality permits, enabling scripts only after review. - Avoid running npm installation with administrator or root privileges. - Document a trusted verification process linking the npm artifact to the declared source repository and reviewed release tag.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description includes broad triggers like completing significant tasks, subagent work, or any action worth recording, which can cause the skill to activate in many unrelated contexts. In a logging skill that sends activity metadata and token usage to a local service, overbroad invocation increases the chance of unintended disclosure of task details and usage information without a clear user decision point.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to log activities and token usage but does not clearly warn that this data is transmitted to a local daemon/API service. Even though the endpoint is localhost, the transmission still exposes potentially sensitive metadata to another process, and users may not expect task descriptions, project names, and token counts to be forwarded automatically.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The 'When to Log' section uses subjective categories such as significant tasks and a catch-all 'any task worth tracking,' leaving the decision to the agent's interpretation. This ambiguity can lead to unnecessary or excessive logging of operational details, project names, and token usage, especially during sensitive work that should not be externally recorded.

Static analysis

No suspicious patterns detected.