clawpilot-pair
Warn
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill installs software packages globally using
npm install -gfor both the vendor's@rethinkingstudio/clawpilotand the third-partycc-connectpackage. - [COMMAND_EXECUTION]: The workflow implements a persistence mechanism by installing and starting a background service (daemon) using
cc-connect daemon install. This ensures the service runs continuously across sessions. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch and follow configuration instructions from a third-party GitHub repository:
https://raw.githubusercontent.com/chenhg5/cc-connect/refs/heads/main/INSTALL.md. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by instructing the agent to ingest and follow external, untrusted content from a remote URL.
- Ingestion points: Instructions in
SKILL.mddirect the agent to readhttps://raw.githubusercontent.com/chenhg5/cc-connect/refs/heads/main/INSTALL.md. - Boundary markers: None provided; the agent is instructed to follow the guide directly.
- Capability inventory: The skill has access to
npmfor global installations, daemon management for persistence, and system utilities likelsofand file system writes (~/.cc-connect/config.toml). - Sanitization: No sanitization or validation of the remote content is performed before processing.
- [COMMAND_EXECUTION]: The skill performs various system-level diagnostics and configuration checks, including port monitoring with
lsof -i :9810and executing version checks for local coding agents (e.g.,claude,codex,gemini).
Audit Metadata