Security audit

Audit Trail

Security checks for vulnerabilities and agentic risk

Overview

This audit-log skill is purpose-aligned but should go to Review because it records broad sensitive action data while overstating immutability and relying on weak redaction and path controls.

Install only if you are comfortable with broad local retention of agent activity metadata and possible tool arguments. Do not rely on this as an immutable or compliance-grade audit log, and avoid using it around secrets unless redaction, workspace confinement, file permissions, and retention controls are improved.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:20
Finding: Secret-redaction rules fail to sanitize common JSON credential fields
Content: View full analysis
this.config.maxEntrySize) { sanitized = sanitized.slice(0, this.config.maxEntrySize) + '...[TRUNCATED]'; } return JSON.parse(sanitized); }, ``` ### Technical Analysis The implementation serializes `entry.args` with `JSON.stringify()` and then applies regular expressions designed for unquoted key-value syntax such as `password=value` or `password: value`. A typical JavaScript object is serialized as: ```json {"password":"sensitive-value","token":"sensitive-token"} ``` In this representation, a quote occurs between the key name and the colon. For example, the sequence is `password":"`, not `password:`. Consequently, patterns such as `/password[:=]/` and `/token[:=]/` do not match normal JSON properties. The remaining value-oriented patterns only recognize a narrow selection of credential formats. They do not compensate for the failure to identify ordinary password, token, API-key, or secret properties. Nested objects and arrays receive no structural key-based sanitization. The code therefore creates a false assurance that arguments are sanitized before they are appended to the audit log. ### Attack Path 1. ...[truncated 1423 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index.js:106
Finding: Audit hashes omit security-relevant record fields
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: index.js:33
Finding: Caller-controlled audit root permits access outside the intended workspace
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation materially overstates the security property by calling the audit trail immutable when it is only a hash chain in mutable local files. Users may rely on it for compliance or incident response, but an attacker with write access can rewrite history and recompute hashes, so the assurance is misleading and unsafe.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill claims an immutable audit trail, but it writes integrity artifacts and reports using ordinary local file operations that the same process can overwrite or delete. A local attacker or compromised agent can tamper with both the audit log and the verification artifacts, defeating non-repudiation and forensic trust.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill silently persists detailed action metadata to disk, including tool usage, timestamps, session identifiers, and partially sanitized arguments, without any user-facing disclosure or consent. This can create unexpected retention of sensitive operational data and increase privacy and compliance risk, especially because the redaction logic is pattern-based and incomplete.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill also creates derived artifacts such as integrity-check logs and compliance reports without disclosure, expanding the amount of persistent metadata on disk. These files can duplicate or summarize sensitive behavior patterns, increasing discoverability and retention surface beyond the primary audit log.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.