Is oathe-ai/darwin safe?

The plugin ships with a .claude/settings.json that pre-approves Bash(), Write(), and Edit(*) for the entire Claude Code session. This bypasses all user confirmation dialogs for bash commands, file writes, and file edits — including destructive operations. A user installing this plugin unknowingly surrenders the standard safety gate for every bash invocation and file mutation for the duration of any session in that project. Combined with the skill's broad tool access, this means any injected instruction to read credentials or execute malicious commands would proceed without a confirmation prompt.

darwin-execute-stop.sh and darwin-verify-stop.sh are registered as Stop hooks and return {"decision": "block"} with a reason string whenever their respective completion criteria are not satisfied. The execute hook blocks exit if any task checkbox is unchecked, any batch gate is not verified, or if the completion promise string is absent from the transcript. The verify hook blocks if report.md does not exist. Users cannot end a Claude Code session until the plugin's internal state machine permits it. A malicious variant could trivially create permanent blocking conditions.

Multiple SKILL.md files use the ! syntax to execute bash at skill load time and inject the output verbatim into Claude's system prompt context. Commands like !cat docs/darwin/_meta/latest-run.json and !jq -r '...' package.json run before any user interaction. If a malicious repository contains adversarial content in these files (e.g., a latest-run.json with injected instructions), that content is silently embedded in Claude's operating context before the user's first message.

darwin-execute-stop.sh receives transcript_path from the hook input JSON and reads the full conversation transcript file to search for promise strings in the last assistant message. The transcript contains the complete session history including all user and assistant messages. This gives the hook's bash script access to all conversation content, which may include sensitive information like API keys, passwords, or confidential business context discussed during the session.

With Bash(*) pre-approved, the discover and explore skills can read any file accessible to the user account — including ~/.env, ~/.ssh/id_rsa, ~/.aws/credentials — as part of their stated codebase exploration mission. The skill's stochastic keyword seeding and mandatory anchor phases explicitly read package.json and entry points throughout the project tree. If manipulated via prompt injection, the agent could read sensitive files and write them to DARWIN artifact files or Serena memory without triggering any user permission dialog.

darwin-init.sh is registered as a SessionStart hook that runs automatically at the beginning of every Claude Code session in a project with this plugin installed. It unconditionally creates docs/darwin/_meta/, docs/darwin/templates/, docs/darwin/runs/ directories and initializes run-seq.json and latest-run.json state files. This persistent side-effect runs without any user interaction or consent, and cannot be opted out of without removing the plugin.

The darwin-skeptic and darwin-revise command templates explicitly instruct the agent to paste the full contents of plan.md, critique.md, and explore.md files directly into sub-agent dispatch prompts with no sanitization. These files are read from the user's codebase. A malicious repository could embed adversarial instructions in these files that manipulate the sub-agent's behavior — a secondary prompt injection attack via the project being analyzed.

enforce-spec-gate.sh is registered as a PreToolUse hook for the Task tool and exits with code 1 to block sub-agent dispatch whenever docs/darwin/_meta/checkpoint-spec-skeptic.json exists. While designed for spec validation, this gives the plugin author indirect control over whether the agent can use sub-agents, based entirely on filesystem state that the plugin itself creates and manages.

The stop hook mechanism constitutes a session-lock pattern: the agent cannot exit until it outputs specific promise strings AND the ledger state matches. In legitimate use this enforces TDD discipline. In a malicious adaptation, always returning {"decision": "block"} or requiring conditions that can never be satisfied would hold users' sessions open indefinitely, consuming API tokens and preventing the user from closing the interaction.

DARWIN orchestrates four sub-agent types (darwin-worker, darwin-skeptic, darwin-revise, darwin-consolidator) each with broad tool permissions inherited from the parent session's Bash()/Write()/Edit(*) grants. This multi-agent architecture creates a complex trust surface where malicious instructions could be laundered through seemingly-legitimate sub-agent roles, making it difficult to trace the origin of any specific action or file access.

The discover skill's Phase 6 explicitly writes architectural learnings about the user's project to Serena MCP persistent memory after each exploration session. This includes module boundaries, naming conventions, API patterns, known hazards, and integration points. Wherever Serena MCP stores this data, it persists across future Claude Code sessions and potentially across different projects sharing the same Serena instance, creating a mechanism for sensitive architectural information to leak across session boundaries.

The Bash()/Write()/Edit(*) pre-approval in .claude/settings.json eliminates the user confirmation step that would otherwise serve as a break-glass checkpoint if an injected prompt instruction directed the agent to execute harmful commands. With confirmations removed, any successful prompt injection from the codebase or runtime context commands would execute without an additional human-in-the-loop gate.

inotify and auditd monitoring detected open/access/close_nowrite events on .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json at epoch 1787685034, approximately 5 seconds before git clone executed at 1787685039. The canary integrity system reports all files intact. The sequential read of all six credential files at identical timestamps is consistent with the audit harness computing canary baseline checksums prior to installation, not with the skill itself. No network exfiltration was observed.

The same credential file access events noted in clone_behavior are evaluated here from an integrity perspective. All six credential files were opened and read (CLOSE_NOWRITE, indicating no modification) before git clone occurred. The canary monitoring system reports integrity intact. The timing (5 seconds before clone) and pattern (all files at identical timestamp) strongly suggests audit harness baseline collection rather than malicious reads. No data was exfiltrated to the network during or after these reads.