Security audit

GhostShield

Security checks for vulnerabilities and agentic risk

Overview

GhostShield is a privacy/protection tool, but its implementation can silently leave secrets in output, copy files outside the chosen repository through symlinks, and persist hidden watermarks in generated code.

Install only after reviewing the code and use it on disposable copies of repositories. Do not rely on it as a sanitizer for secrets, do not process untrusted repositories with symlinks, avoid custom watermark IDs, and inspect generated output before publishing or running it.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: ghostshield/obfuscator.py:177
Finding: PII Sanitization Fails Because File Paths and Match Offsets Are Inconsistent
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: ghostshield/obfuscator.py:80
Finding: Repository Copy Dereferences Symbolic Links and Can Export Files Outside the Input Tree
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: ghostshield/obfuscator.py:294
Finding: Unvalidated Watermark Identifier Allows Python Source Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: ghostshield/obfuscator.py:120
Finding: Silent Exception Handling Causes Security Transformations to Fail Open
Content: View full analysis
= 2: content = self._obfuscate_code_style(content) if level >= 3: content = self._inject_fake_features(content) with open(file_path, 'w', encoding='utf-8') as f: f.write(content) except Exception as e: pass ``` ```python # ghostshield/obfuscator.py:148-170 def _process_doc_file( self, file_path: Path, level: int, pii_results: List[Dict[str, Any]], ): """Process document file""" try: with open(file_path, 'r', encoding='utf-8', errors='ignore') as f: content = f.read() content = self._sanitize_pii(content, pii_results, file_path) if level >= 2: content = self._obfuscate_doc_style(content) if level >= 3: content = self._inject_fake_features(content, is_code=False) with open(file_path, 'w', encoding='utf-8') as f: f.write(content) except Exception as e: pass ``` ### Technical Analysis Both processing methods catch every exception and discard it. The caller receives no indication that a file could not be read, transformed, or written. `obfuscate()` continues and returns a normal result, after which `GhostShield.process()` can produce a successful result. This is a fail-open design for a security tool. Unsupported encodings, filesystem ...[truncated 1440 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (43)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 81% confidence
Finding: The watermark example contains invisible Unicode characters after the visible token, which can act as hidden instructions, covert markers, or steganographic content. In a skill centered on watermarking and obfuscation, this is more concerning because it normalizes embedding non-obvious data into code/comments, which can mislead reviewers, poison downstream processing, or bypass simplistic filters.
Content: Scanner excerpt · README.md (reported line 162)May include surrounding context.
python
# Author: [email-removed] # Watermark: GS-20260404230500‌‌ # Note: Alternative approach considered def get_user_data(user_id):

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill claims a three-level obfuscation system, but findings indicate it also performs style fingerprinting, similarity comparison, and Git commit analysis while apparently not fully implementing the advertised protections. A tool that extracts fingerprints while overstating protective features can invert user expectations and increase privacy risk rather than reduce it.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims a three-level obfuscation system, but findings indicate it also performs style fingerprinting, similarity comparison, and Git commit analysis while apparently not fully implementing the advertised protections. A tool that extracts fingerprints while overstating protective features can invert user expectations and increase privacy risk rather than reduce it.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims a three-level obfuscation system, but findings indicate it also performs style fingerprinting, similarity comparison, and Git commit analysis while apparently not fully implementing the advertised protections. A tool that extracts fingerprints while overstating protective features can invert user expectations and increase privacy risk rather than reduce it.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · ghostshield/pii_detector.py (reported line 75)May include surrounding context.
python
}, "github_token": { "pattern": r'ghp_[a-zA-Z0-9]{36}', "description": "GitHub Personal Access Token", }, }

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This module performs broad sensitive-data discovery and local identity harvesting functions that do not align with the stated purpose of code-style obfuscation against distillation. That mismatch increases the risk that the skill collects emails, names, tokens, internal URLs, and other secrets from a user's workspace without a clear, necessity-bound reason.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Extracting all Git commit authors via git log collects contributor identities and emails across the repository history, which exceeds what is reasonably needed for code-style protection. In the context of a 'ghostshield' obfuscation skill, this looks like unnecessary local identity enumeration and increases privacy and insider-profiling risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill claims to protect against style distillation, but this file actually profiles a user's code, documentation, and commit habits and generates a persistent style fingerprint. In skill context, that is dangerous because it enables attribution, behavioral tracking, and privacy-invasive analysis that is opposite to the advertised shielding purpose, making user consent and expectation mismatch especially severe.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The markdown shows ghostshield process producing a rewritten repository, including Level 2/3 behaviors such as renaming, timestamp shifts, noise injection, and contradictory decision comments. Because these operations alter user files and may affect correctness or maintainability, the skill description should explicitly warn users to review outputs and avoid using transformed code blindly.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises CLI-style processing over repositories and examples imply file reads, file writes, and shell/Git invocation, but it declares no explicit tool scope or permissions. This increases the chance an agent executes broader filesystem or shell actions than a user expects, especially when operating on entire repositories and Git metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown promotes repository-wide transformation, watermark insertion, and export workflows without a clear warning that source files may be modified and behavior may change. In this context, silent or poorly signposted mutation is risky because users may run it on production code, commit hidden markers, or degrade functionality across an entire repository.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code's natural-language interface is consistently presented in Chinese, including the CLI description, help text, status messages, and reports. Because the skill does not offer any language/locale opt-in or indicate that it is intentionally limited to a Chinese-speaking context, it violates the policy against forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file contains natural-language documentation and usage text entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a region-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language descriptions, docstrings, and usage explanations are presented in Chinese only, which effectively forces a specific language for operators or maintainers of the skill. The file does not offer a language choice, opt-in, or documented justification for this locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code copies an input tree and then silently overwrites or appends to many files during processing without any confirmation, dry-run mode, backup, or per-file disclosure. In a tool explicitly designed to conceal stylistic signals, broad silent mutation increases the risk of unreviewed destructive changes, hidden watermarking, and unintended corruption of source or documentation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This skill includes Git history inspection and purported rewrite-oriented obfuscation features that go beyond simple file/style sanitization. In context, rewriting or staging metadata obfuscation can destroy provenance, hinder audits, and facilitate anti-forensics or policy evasion, especially because the feature is framed as concealment rather than ordinary privacy protection.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · ghostshield/obfuscator.py (reported line 390)May include surrounding context.
python
try: # 获取所有作者 import subprocess result = subprocess.run( ["git", "log", "--format=%an", "--all"], cwd=input_path, capture_output=True,

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The reference-style injection capability is not necessary for defensive PII sanitization and instead enables deliberate imitation or contamination of another project's coding style. In context, that can be used to misattribute authorship, poison forensic signals, or mask origin, making the skill materially more dangerous than its stated protective purpose suggests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language descriptions such as the module docstring that are exclusively in Chinese. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · ghostshield/pii_detector.py (reported line 272)May include surrounding context.
python
try: # 获取所有提交作者 result = subprocess.run( ["git", "log", "--format=%an <%ae>", "--all"], cwd=repo_path, capture_output=True,

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Scanning .git/config specifically for user name and email gathers local identity information unrelated to the advertised anti-distillation function. Even if done locally, this creates unnecessary privacy exposure and can be combined with other collected data to profile the user or repository contributors.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Natural-language descriptions and docstrings in this file are consistently written in Chinese, with no indication that users may choose another language or locale. Under the language/locale policy, forcing a specific language without opt-in is a policy concern unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file inspects Git commit history, extracting prefixes, keywords, message lengths, and emoji usage, which can reveal personal work patterns and author-identifying traits. That capability is not necessary for a code-style protection tool, so in this context it increases privacy risk and expands the collected behavioral fingerprint beyond what users would reasonably expect.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · ghostshield/style_analyzer.py (reported line 575)May include surrounding context.
python
try: # 获取 commit messages cmd_result = subprocess.run( ["git", "log", "--format=%s", "--all", "-n", "500"], cwd=repo_path, capture_output=True,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code reads up to 500 commit subjects from the repository without any visible disclosure, prompt, or permission boundary. In a tool marketed as defensive style shielding, silent collection of commit-history signals is particularly risky because users are unlikely to expect that their development history is being mined for stylistic profiling.
Content: No source excerpt is available for this finding.