Security audit

chitin-moat

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it presents itself as enforcing high-impact agent permissions while only providing advisory instructions and incomplete config scripts.

Review before installing. This skill may be useful as a checklist or audit helper, but do not rely on it as a real security boundary for shell commands, file access, secrets, messaging, financial actions, or sub-agents unless you add separate authenticated identity checks and runtime enforcement outside the model instructions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/resolve_channel.py:11
Finding: Sovereign Access Is Granted Without Verifying the Configured Owner Identity
Content: View full analysis
dict: with open(config_path) as f: config = yaml.safe_load(f) # Check explicit channel matches for ch in config.get("channels", []): pattern = ch["id"] # Direct match or glob match if channel_id == pattern or fnmatch.fnmatch(channel_id, pattern): level = ch["level"] # Check overrides (for Discord-style server:channel patterns) # channel_id format: "discord:server_id:channel_name" or "discord:server_id" parts = channel_id.split(":") if len(parts) >= 3: channel_name = parts[-1] for ov in ch.get("overrides", []): if fnmatch.fnmatch(channel_name, ov["channel"]): return { "channel_id": channel_id, "level": ov["channel"], "resolved_level": ov["level"], "source": f"override '{ov['channel']}' in {pattern}", } return { "channel_id": channel_id, "resolved_level": level, "source": f"channel rule '{pattern}'", } ``` The example configuration declares an owner and associates that owner's channel with sovereign access: ```yaml # Owner identity — used to verify sovereign-level access owner: telegram: "REPLACE_WITH_YOUR_TELEGRAM_USER_ID" # Channel mappings channels: # Direct message with owner = full autonomy - id: "telegram:REPLACE_WITH_YOUR_TELEGRAM_USER_ID" level: sovereign ``` ### Technical Analysis The resolver loads the complete configuration but never ...[truncated 2076 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:70
Finding: Documented Permission Boundaries Are Advisory and Lack Runtime Enforcement
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/validate_config.py:40
Finding: Privileged Wildcard Rules and First-Match Shadowing Pass Configuration Validation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description emphasizes active enforcement of channel-based permission boundaries for AI agents and suggests a runtime security control system. The supplied code does not implement enforcement logic for exec, file I/O, secrets, or messaging access. Instead, it only audits an existing configuration file and prints a human-readable report with basic checks. While auditing channel permissions is mentioned in the description as a possible use case, the primary declared purpose is broader and centered on enforcement, which this code does not do. The file read is consistent with an audit utility, but it is still an undeclared capability given the empty declared permissions. Overall, the code materially underdelivers relative to the declared behavior and has a narrower, different primary function.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/permission-matrix.md (reported line 7)May include surrounding context.
md
|------------------------|-----------|------------|-------------|----------|--------| | Execute shell commands | ✅ | ❌ | ❌ | ❌ | ❌ | | Read/write files | ✅ | ⚠️ scoped | ❌ | ❌ | ❌ | | Access secrets/env | ✅ | ❌ | ❌ | ❌ | ❌ | | Send external messages | ✅ | ⚠️ confirm | ❌ | ❌ | ❌ | | Financial operations | ✅ | ❌ | ❌ | ❌ | ❌ | | Search/retrieve info | ✅ | ✅ | ✅ | ❌ | ❌ |

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This is a true vulnerability: when an override matches, the function returns "level": ov["channel"] instead of returning the effective trust level in that field. Any downstream consumer that reads the returned "level" field rather than "resolved_level" may misinterpret a glob/channel pattern as the permission tier, causing incorrect enforcement or fallback behavior. In a skill whose purpose is to enforce channel-based trust boundaries, this kind of metadata corruption is especially dangerous because it can undermine the very access-control decision path protecting exec, file I/O, secrets, and messaging.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.