ClawHub
Back to skill

Security audit

StateRoot

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent install purpose, but it uses remote script execution and persistent AI-agent hook installation while its manifest understates those durable changes.

Review this carefully before installing. Prefer a downloaded, inspected, version-pinned, and signature-verified installer or MSI over piping remote scripts into a shell. Run dry-run or interactive setup first, confirm exactly which harnesses will be modified, and make sure you are comfortable with StateRoot persisting hooks and a built-in skill across future agent sessions. Do not rely on the manifest's no-persistence claim for this package.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:106
Finding
Mutable Remote Installers Are Executed Directly Without Authenticating the Installer<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:106`, `SKILL.md:115`, `SKILL.md:122`; `references/install.md:11`, `references/install.md:27`, `references/install.md:35` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh ``` ```powershell irm https://github.com/CognizTech/stateroot/releases/latest/download/install.ps1 | iex ``` The same installation patterns are repeated in `references/install.md`. ### Technical Analysis The Skill retrieves an installation script from a mutable `latest` GitHub release URL and passes the response directly to a command interpreter. The effective code executed on a user's machine can therefore change after this Skill package has been reviewed. The documentation states that the installer verifies the downloaded StateRoot binary against `checksums.txt`. That does not authenticate the installer itself: the shell or PowerShell interpreter has already started executing the remotely retrieved script before any binary checksum validation occurs. If both the binary and checksum are served from the same compromised release channel, an ordinary unkeyed checksum also does not establish publisher authenticity. The Skill appropriately says to ask for confirmation, but user confirmation does not eliminate the supply-chain risk. The installation of a CLI is necessary for the declared bootstrap function; direct execution of a mutable network response is not the minimum-risk method necessary to accomplish it. ### Attack Path 1. An attacker compromises the GitHub repository, maintainer account, release workflow, release assets, or another component capable of changing the response for the mutable `latest` installer URL. 2. The attacker replaces `install.sh` or `install.ps1` with a malicious script. 3. The user or agent follows the Skill instructions. 4. `curl | sh` or `irm | ...[truncated 1092 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not pipe network responses directly into `sh`, PowerShell, or another interpreter. 2. Pin downloads to a specific release version rather than the mutable `latest` alias. 3. Download the installer and its detached signature as separate files. 4. Verify the installer using a trusted public key distributed independently of the release assets. 5. Display the verified installer path and require explicit confirmation before execution. 6. Pin and verify the final executable independently with a signed release manifest. 7. Prefer an established signed package format where available, such as the signed Windows MSI. 8. Document the expected installer digest and exact files it will create or modify. 9. Ensure verification fails closed and never advise users to bypass a signature or checksum failure. ]]>

T06 · System Persistence

Error
Location
SKILL.md:143
Finding
Setup Installs Persistent Cross-Session Hooks and an Unreviewed Built-In Skill<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:143-174`; `references/disclosure.md:15-24`, `references/disclosure.md:45-47` **Vulnerability Type**: Persistent agent-harness modification **Risk Level**: High ### Vulnerable Code ```bash stateroot setup ``` ```bash stateroot setup --yes ``` The setup behavior is described as follows: ```text - identity — canonical soul / USER.md (import OpenClaw or Hermes if present, or a deterministic draft) - harnesses — detect agents, write session hooks - skills — seed the built-in StateRoot skill into detected agent directories ``` The disclosure further states: ```text Harness hooks persist across sessions until `stateroot uninstall`. That is intended: it is how the built-in skill becomes default. ``` ### Technical Analysis The setup command writes session hooks and copies a built-in StateRoot Skill into detected AI-agent configuration directories. Those hooks survive the bootstrap run and affect future sessions, making the installed Skill the default workflow across supported harnesses. Persistence is related to the declared continuity functionality, but the scope is security-sensitive: one bootstrap operation can modify multiple agent environments and place future behavior under the control of the downloaded CLI. The generated built-in Skill and exact hook contents are not present in the audited package, so their safety cannot be verified statically. The non-interactive `--yes` path increases this concern because defaults can be applied without per-harness review. If the remotely installed CLI is malicious or compromised, setup becomes a direct persistence mechanism. ### Attack Path 1. A malicious or compromised StateRoot executable is installed, including through the remote-installer path described in the preceding finding. 2. The user or agent runs `stateroot setup` or `stateroot setup --yes`. 3. The executable detects installed AI coding harnesses. 4. It writes persistent session hooks and s ...[truncated 1056 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Make integration opt-in separately for every detected harness. 2. Before writing anything, show the exact target paths, hook contents, generated Skill contents, and configuration changes. 3. Require explicit confirmation for each persistent integration; do not use broad defaults merely because execution is non-interactive. 4. Include the generated built-in Skill and hook templates in the audited package or another signed, version-pinned artifact. 5. Authenticate generated or downloaded integration content before installation. 6. Back up modified configuration and provide an atomic rollback procedure. 7. Restrict writes to the specifically selected harness rather than every detected harness. 8. Provide a setup mode that installs the CLI without persistent hooks. 9. Clearly report all installed persistence points and verify that `stateroot uninstall` removes each one. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
skill.manifest.json:19
Finding
Manifest Incorrectly Declares No Workspace I/O or Persistent State<![CDATA[ ## Vulnerability Details **File Location**: `skill.manifest.json:19-20`; contradicted by `SKILL.md:143-187` and `references/disclosure.md:15-24` **Vulnerability Type**: Inaccurate security and permission metadata **Risk Level**: Medium ### Vulnerable Code ```json "workspace_io_mode": "none", "persistent_state_mode": "none", ``` The documented behavior contradicts these declarations: ```text | Harness config dirs | setup / `stateroot install` | session hooks so the built-in skill can run | | `<project>/.stateroot/` | `stateroot init` only | project store | | Project stubs | `stateroot init` | e.g. `.cursor/rules/stateroot.mdc`, Claude command, AGENTS.md block | ``` The project initialization command is: ```bash stateroot init ``` ### Technical Analysis The manifest claims that the Skill performs no workspace I/O and uses no persistent state. The Skill instructions explicitly direct the installed CLI to create persistent global configuration, identity data, harness hooks, a project `.stateroot/` directory, and project-specific stubs. It may also update an `AGENTS.md` block and initialize Git in a non-Git directory. This mismatch can undermine permission gating, automated review, and user expectations. A consumer relying on the manifest could treat the Skill as read-only and ephemeral even though its primary setup and initialization workflows intentionally perform durable writes. The writes are relevant to the declared continuity function, but they must be accurately represented. Claiming no persistence is not consistent with the minimum disclosure necessary for informed authorization. ### Attack Path 1. A marketplace, agent runtime, or user evaluates the manifest. 2. The declarations `workspace_io_mode: none` and `persistent_state_mode: none` lead the consumer to expect no durable modifications. 3. The Skill instructs execution of `stateroot setup` or `stateroot init`. 4. Those commands write global state, harness hooks, project state, and pr ...[truncated 641 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Change `workspace_io_mode` to the schema value representing project writes. 2. Change `persistent_state_mode` to the schema value representing durable user and harness state. 3. Enumerate all potential write locations in machine-readable metadata, including: - `~/.local/bin/stateroot` - `~/.config/stateroot/` or `%APPDATA%\stateroot\` - `~/.stateroot/` - Detected harness configuration directories - `<project>/.stateroot/` - Project stubs and `AGENTS.md` 4. Declare that setup installs cross-session hooks. 5. Separate installation, global setup, and project initialization into distinct permission scopes. 6. Require workspace-write authorization before `stateroot init`. 7. Change the manifest risk status from `trusted` or leave it untrusted until the remote installer, executable, generated hooks, and built-in Skill have been independently validated. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (26)

Self-Modification

High
Category
Rogue Agent
Content
required_binaries: []
    writes_to_disk: true
    network_access:
      - "github.com (official release assets and checksums during install/self-update only)"
    data_handling:
      uploads_to_external: false
      requires_user_confirmation: true
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
required_binaries: []
    writes_to_disk: true
    network_access:
      - "github.com (official release assets and checksums during install/self-update only)"
    data_handling:
      uploads_to_external: false
      requires_user_confirmation: true
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
required_binaries: []
    writes_to_disk: true
    network_access:
      - "github.com (official release assets and checksums during install/self-update only)"
    data_handling:
      uploads_to_external: false
      requires_user_confirmation: true
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
required_binaries: []
    writes_to_disk: true
    network_access:
      - "github.com (official release assets and checksums during install/self-update only)"
    data_handling:
      uploads_to_external: false
      requires_user_confirmation: true
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
required_binaries: []
    writes_to_disk: true
    network_access:
      - "github.com (official release assets and checksums during install/self-update only)"
    data_handling:
      uploads_to_external: false
      requires_user_confirmation: true
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
required_binaries: []
    writes_to_disk: true
    network_access:
      - "github.com (official release assets and checksums during install/self-update only)"
    data_handling:
      uploads_to_external: false
      requires_user_confirmation: true
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
required_binaries: []
    writes_to_disk: true
    network_access:
      - "github.com (official release assets and checksums during install/self-update only)"
    data_handling:
      uploads_to_external: false
      requires_user_confirmation: true
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High
Category
Rogue Agent
Content
required_binaries: []
    writes_to_disk: true
    network_access:
      - "github.com (official release assets and checksums during install/self-update only)"
    data_handling:
      uploads_to_external: false
      requires_user_confirmation: true
Confidence
90% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Ae1

High
Category
analysis-evasion
Content
Run the check next to this `SKILL.md` (never writes):
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Chaining Abuse

High
Category
Tool Misuse
Content
**Linux (x86_64):**

```bash
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
```

Installs to `~/.local/bin`. Put that directory on `PATH` if `stateroot` is still not found. Needs glibc 2.17 or newer (Ubuntu 16.04, Debian 9, RHEL 7, and later).
Confidence
99% confidence
Finding
The `| sh` construct is a classic command-chaining risk because it removes the opportunity to inspect or validate downloaded content before execution. In an install skill, this is especially dangerous because users may follow the instruction verbatim and grant code execution based on trust in the documentation alone.

Chaining Abuse

High
Category
Tool Misuse
Content
**macOS (Apple Silicon):**

```bash
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
```

Installs the release artifact `stateroot-macos-aarch64` to `~/.local/bin` after SHA-256 verification. Intel Macs are not currently supported by a release binary; build from source per [references/install.md](references/install.md).
Confidence
99% confidence
Finding
This macOS command has the same chaining issue: network-fetched content is executed immediately via the shell. The skill context makes it more dangerous because it is framed as the official installation path, which increases the likelihood of blind execution by users or agents.

External Script Fetching

High
Category
Supply Chain
Content
## Confirmation

- Ask before `curl … \| sh` or `irm … \| iex`.
- Interactive `stateroot setup` is preferred. `--yes` / non-TTY uses defaults (binary-detected harnesses only).
- `--dry-run` prints planned writes and touches nothing.
- Destructive removal is a different command (`uninstall`, `remove`) and is not part of bootstrap.
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
## Confirmation

- Ask before `curl ... \| sh` or `irm ... \| iex`.
- Interactive `stateroot setup` is preferred. `--yes` / non-TTY uses defaults (binary-detected harnesses only).
- `--dry-run` prints planned writes and touches nothing.
- Destructive removal is a different command (`uninstall`, `remove`) and is not part of bootstrap.
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Chaining Abuse

High
Category
Tool Misuse
Content
## Linux

```bash
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
```

Downloads `stateroot-linux-x64`, verifies SHA-256 against `checksums.txt` (fail closed), installs to `~/.local/bin`. x86_64 only for current releases. Needs glibc 2.17 or newer (Ubuntu 16.04, Debian 9, RHEL 7, and later).
Confidence
98% confidence
Finding
The `| sh` chain removes the inspection boundary between retrieval and execution, amplifying the danger of any compromise in the source, release path, or user environment. In a bootstrap/install document, this materially increases the chance of arbitrary code execution because the command is presented as the primary happy path.

Chaining Abuse

High
Category
Tool Misuse
Content
## macOS (Apple Silicon)

```bash
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
```

The installer selects `stateroot-macos-aarch64`, verifies it against `checksums.txt`, and installs it to `~/.local/bin`.
Confidence
98% confidence
Finding
The same retrieval-to-execution chaining exists in the macOS instructions, with no pause for inspection or explicit warning. This is dangerous because users are likely to copy-paste the command verbatim, granting immediate execution to code controlled by a remote endpoint.

Session Persistence

Medium
Category
Rogue Agent
Content
Sections: **identity**, **harnesses**, **skills**.

- identity — canonical soul / USER.md (import OpenClaw or Hermes if present, or a deterministic draft)
- harnesses — detect agents, write session hooks
- skills — seed the built-in StateRoot skill into detected agent directories

Non-TTY agent shell (same as `--yes`; do not use interactive `read`):
Confidence
91% confidence
Finding
The setup step explicitly detects agent environments, writes session hooks, and seeds skills into agent directories, which establishes persistence across future sessions. Even if this is the product's intended function, persistent modification of agent startup behavior can affect later sessions, expand trust boundaries, and make rollback or auditing harder if the installed content is compromised.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Inventing download URLs or installing via `npm` / `pip` / a random clone
- Guessing unsupported release assets or architectures
- Piping `install.sh` without asking
- Creating or editing `.stateroot/` or `~/.stateroot/` with file tools
- Running `setup --blank-slate` unprompted
- Teaching resume / checkpoint / handoff / memory here after setup succeeded
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium
Category
Rogue Agent
Content
Authoritative: https://stateroot.dev/docs/reference/faq

Quote CLI output. Do not hand-write `.stateroot/`, `~/.stateroot/`, or harness stubs.

| Symptom | Action |
| --- | --- |
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
| `stateroot --version` works, harnesses have no hooks | Run `stateroot setup` (this skill still applies). `stateroot install` is harness wiring only. |
| macOS Intel / unsupported architecture | Current macOS releases target Apple Silicon. Build from source (see install.md). |
| `doctor` non-zero | Broken local setup. Quote the output. Missing synthesis keys are not a failure. |
| Checksum mismatch / installer refuse | Fail closed. Re-download from the official latest release. Do not skip verification. |
| `not a stateroot project` | Project command on a tree with no `.stateroot/`. Run `stateroot init` from the repo root if the user wants this project on StateRoot — then expire this skill. |
| User hesitated to pipe `install.sh` | Stop. Give them the URL and the MSI/script to run themselves. |
| Setup already configured | Default is skip-unless-reconfigure. Do not pass `--blank-slate` unless they asked. |
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation instructs users to pipe a remotely fetched shell script directly into `sh`, which executes network-delivered code without giving the user an opportunity to inspect it first. Although the text notes downstream checksum verification for the binary, the installer script itself is still trusted implicitly, so a compromised release asset, repository, CDN path, or transport chain could lead to arbitrary code execution.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The PowerShell command `irm ... | iex` fetches a script from the network and immediately executes it in the current session. This creates the same arbitrary code execution risk as shell piping, with no inspection boundary and no explicit warning to the user about running remote code.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The description states that after setup, the built-in StateRoot skill 'owns daily workflow,' which implies persistent, broad control over future agent behavior without clearly bounded activation conditions. In a bootstrap/install skill, this kind of ambiguous authority expansion can cause unintended invocation, privilege creep, or unsafe delegation of future tasks to another skill layer the user did not explicitly approve for each use.

External Script Fetching

Low
Category
Supply Chain
Content
**Linux (x86_64):**

```bash
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
```

Installs to `~/.local/bin`. Put that directory on `PATH` if `stateroot` is still not found. Needs glibc 2.17 or newer (Ubuntu 16.04, Debian 9, RHEL 7, and later).
Confidence
98% confidence
Finding
Fetching a remote installer script from GitHub and piping it directly to the shell executes unreviewed network content immediately. If the release asset, GitHub account, repository, transport, or redirect path is compromised, arbitrary code runs with the user's privileges at install time.

External Script Fetching

Low
Category
Supply Chain
Content
**macOS (Apple Silicon):**

```bash
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
```

Installs the release artifact `stateroot-macos-aarch64` to `~/.local/bin` after SHA-256 verification. Intel Macs are not currently supported by a release binary; build from source per [references/install.md](references/install.md).
Confidence
98% confidence
Finding
This repeats the same unsafe installation pattern for macOS: remote content is downloaded and executed in one step. The mention of SHA-256 verification inside the script does not protect the initial script itself from tampering or repository compromise.

External Script Fetching

Low
Category
Supply Chain
Content
## Linux

```bash
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
```

Downloads `stateroot-linux-x64`, verifies SHA-256 against `checksums.txt` (fail closed), installs to `~/.local/bin`. x86_64 only for current releases. Needs glibc 2.17 or newer (Ubuntu 16.04, Debian 9, RHEL 7, and later).
Confidence
95% confidence
Finding
The command fetches an external installer script from GitHub and runs it, creating a supply-chain execution path through a mutable remote resource. Even if the script later verifies the downloaded binary, the script itself is an unverified executable input and therefore a meaningful attack surface.

Static analysis

No suspicious patterns detected.