Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious with medium confidence, mainly because its Linux and macOS setup instructions pipe a mutable remote installer directly into a shell before authenticating it.
Review the install method before proceeding: these instructions run a remotely fetched installer before authenticating it, so a compromised release could execute with your user permissions. Consider waiting for a version-pinned installer with independently verifiable authentication. The scanner also reports an uninstall-and-purge option not disclosed in the stated purpose. Skillspector's scan was partial because three local references could not be resolved; the AIG scan completed with no findings, but that does not resolve the identified risks.
The supplied shell commands remove StateRoot rather than install or configure it. The purge command additionally deletes its user-level directory. These removal and deletion capabilities are not disclosed in the declared setup purpose.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
required_binaries: []
writes_to_disk: true
network_access:
- "github.com (official release assets and checksums during install/self-update only)"
- "stateroot.dev (anonymous product telemetry from release CLI builds only; off in dev/nightly builds; STATEROOT_NO_PING=1 opts out)"
data_handling:
uploads_to_external: false
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
## Network
- **Install / self-update:** GitHub releases (`CognizTech/stateroot`) for the binary and `checksums.txt`. Running the installer requires installation authorization; an explicit request to install already provides it.
- **Setup / init:** local disk. No StateRoot server.
- **Anonymous product telemetry (release builds only):** the installed CLI emits a small set of anonymous product-health events (install/update observed, first delivered continuity digest, one active-day per project/harness/day, harness switches) to `stateroot.dev` over HTTPS. Events carry a random install UUID, an opaque keyed project digest, coarse OS/arch, CLI version, cohort, and canonical harness ids — never prompts, paths, filenames, content, usernames, hostnames, IPs, or request bodies. Delivery is detached and never blocks a command. Dev/nightly builds emit nothing. Opt out entirely: `STATEROOT_NO_PING=1`. Full field-by-field contract: https://stateroot.dev/docs/guides/privacy
- **Optional later:** i
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
stateroot self-update
stateroot self-update --check
stateroot self-update --tag nightly
stateroot self-update --tag v0.2.14
stateroot self-update --check --tag nightly
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
stateroot self-update --check stateroot self-update --tag nightly stateroot self-update --tag v0.2.14 stateroot self-update --check --tag nightly
`self-update` follows the running binary's channel: a production build follows the latest production release, and a dev/nightly build follows `nightly`. Background updates retain that channel too. `--tag nightly` explicitly selects the rolling preview from `main`; `--tag v0.2.14` explicitly selects that production release, including switching back from nightly. Updates re-arm harness integrations and refresh editor release metadata automatically.
The pipe connects downloaded bytes directly to a shell, crossing the remote-content-to-code boundary without a verification step. This is the same Linux installation weakness reported by SC2, not separate evidence of malicious chaining, but compromise of the release asset could yield arbitrary user-level execution.
Linux (x86_64 or ARM64):
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
The installer selects the matching Linux release binary and installs it to ~/.local/bin. Put that directory on PATH if stateroot is still not found. Needs glibc 2.17 or newer (Ubuntu 16.04, Debian 9, RHEL 7, and later).
The macOS pipeline sends remote script content directly into sh before the installer itself has been authenticated. This duplicates the SC2 supply-chain issue at the same location rather than demonstrating a distinct chaining attack; the installation context explains the command but does not eliminate its arbitrary-code-execution risk.
macOS (Apple Silicon):
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
Installs the release artifact stateroot-macos-aarch64 to ~/.local/bin after SHA-256 verification. Intel Macs are not currently supported by a release binary; build from source per references/install.md.
The pipe sends fetched content directly to sh, turning a download into immediate code execution without an intervening verification step. This is the same underlying Linux installer vulnerability as the SC2 finding at line 11, not a separate attack; installation context explains the purpose but does not remove the supply-chain risk.
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
Selects stateroot-linux-x64 or stateroot-linux-arm64 for the host, verifies SHA-256 against checksums.txt (fail closed), and installs to ~/.local/bin. Needs glibc 2.17 or newer (Ubuntu 16.04, Debian 9, RHEL 7, and later).
Piping the downloaded macOS installer into sh executes remote content before it can be authenticated or reviewed. This duplicates the SC2 issue at line 35; a compromised installer could access files, credentials, and harness configurations available to the invoking user.
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
The installer selects stateroot-macos-aarch64, verifies it against checksums.txt, and installs it to ~/.local/bin.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Not this skill's job once setup has run. The built-in skill / CLI owns daily use. For reference only:
stateroot self-update
stateroot self-update --check
stateroot self-update --tag nightly
stateroot self-update --tag v0.2.14
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
stateroot self-update stateroot self-update --check stateroot self-update --tag nightly stateroot self-update --tag v0.2.14 stateroot self-update --check --tag nightly
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
stateroot self-update
stateroot self-update --check
stateroot self-update --tag nightly
stateroot self-update --tag v0.2.14
stateroot self-update --check --tag nightly
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
stateroot self-update --check --tag nightly
`self-update` follows the running binary's channel: a production build follows the latest production release, and a dev/nightly build follows `nightly`. Background updates retain that channel too. `--tag nightly` explicitly selects the rolling preview from `main`; `--tag v0.2.14` explicitly selects that production release, including switching back from nightly. Updates re-arm harness integrations and refresh editor release metadata automatically.
If a public GitHub API quota is exhausted, current clients use published release metadata with checksum verification. A GitHub account or token is optional; a `403` alone does not prove a rate limit.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Authoritative: https://stateroot.dev/docs/reference/faq
Quote CLI output. Do not hand-write `.stateroot/`, `~/.stateroot/`, or harness stubs.
| Symptom | Action |
| --- | --- |
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| `stateroot --version` works, harnesses have no hooks | Run `stateroot setup` (this skill still applies). `stateroot install` is harness wiring only. |
| macOS Intel / unsupported architecture | Current macOS releases target Apple Silicon. Build from source (see install.md). |
| `doctor` non-zero | Broken local setup. Quote the output. Missing synthesis keys are not a failure. |
| Checksum mismatch / installer refuse | Fail closed. Re-download from the official latest release. Do not skip verification. |
| `not a stateroot project` | Project command on a tree with no `.stateroot/`. Run `stateroot init` from the repo root if the user wants this project on StateRoot — then expire this skill. |
| User hesitated to pipe `install.sh` | Stop. Give them the URL and the MSI/script to run themselves. |
| Setup already configured | Default is skip-unless-reconfigure. Do not pass `--blank-slate` unless they asked. |
The Linux installation command immediately executes a mutable remote script without authenticating or reviewing it first. A compromised release account or malicious replacement asset could execute arbitrary commands with the user's privileges, potentially affecting credentials and persistent agent integrations; installation authorization does not establish script integrity.
Linux (x86_64 or ARM64):
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
The installer selects the matching Linux release binary and installs it to ~/.local/bin. Put that directory on PATH if stateroot is still not found. Needs glibc 2.17 or newer (Ubuntu 16.04, Debian 9, RHEL 7, and later).
The macOS command executes an unverified installer fetched from a mutable latest-release URL. The stated SHA-256 verification of the eventual binary does not authenticate the installer that is already executing, so a compromised installer could bypass that check and modify user files or agent integrations.
macOS (Apple Silicon):
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
Installs the release artifact stateroot-macos-aarch64 to ~/.local/bin after SHA-256 verification. Intel Macs are not currently supported by a release binary; build from source per references/install.md.
The Linux installation command immediately executes a remotely fetched script from a mutable latest-release URL without first authenticating that script. Compromise of the release publisher or release asset could yield arbitrary execution with the invoking user's permissions; the stated checksum verification of the subsequently downloaded binary does not protect the installer itself.
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
Selects stateroot-linux-x64 or stateroot-linux-arm64 for the host, verifies SHA-256 against checksums.txt (fail closed), and installs to ~/.local/bin. Needs glibc 2.17 or newer (Ubuntu 16.04, Debian 9, RHEL 7, and later).
The macOS command executes a mutable remote installer without prior authentication of its contents. An attacker controlling the release asset could run arbitrary commands as the user, and checksum verification performed by that installer cannot establish the installer's own trustworthiness.
curl -sSfL https://github.com/CognizTech/stateroot/releases/latest/download/install.sh | sh
The installer selects stateroot-macos-aarch64, verifies it against checksums.txt, and installs it to ~/.local/bin.