agent-behavior-baseline

• Outcome: Review
• Latest audit: Nov 7, 2026 · 3:24 PM UTC
• Version: 1.0.0

Overview

The skill is rated suspicious because its evaluation script can run task-provided commands through a shell, creating a security risk if an untrusted task suite is used.

Consider installing only if you trust the task suites that will be run and can keep them reviewed and controlled. Scanner coverage was partial because a local path-like reference in SKILL.md could not be resolved, so the evidence is incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This is the same execution boundary identified by AST4, not an independent exploit: task-controlled cmd, cwd, and timeout values flow into subprocess execution without policy enforcement. If a lower-trust contributor or agent-generated artifact controls the suite, its contents become shell instructions with the runner's authority; merely being JSON does not make the suite safe to execute.

Content

Scanner excerpt · scripts/eval_suite.py (reported line 27)May include surrounding context.

python

cmd, expect_contains?, timeout?}
Results: state/evals/last-run.json (+ a trace row when TRACE_DB is available).
"""
import argparse
import json
import os
import subprocess
import sys
import time
from datetime import datetime, timezone

sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))


def run_task(t):
    t0 = time.time()
    if t["kind"] == "file_exists":
        p = os.path.expanduser(t["path"])
        ok = os.path.exists(p)
        out = p if ok else "missing: " + p
    else:
        p = subprocess.run(t["cmd"], shell=True, text=True, capture_output=True,
                           timeout=t.get("timeout", 20), cwd=t.get("cwd"))
        out = (p.stdout or "") + (p.stderr or "")
        ok = p.returncode == 0
        if ok and t.get("expect_contains"):
            ok = t["expect_contains"] in out
        if ok and t.get("expect_not_contains"):
            ok = t["expect_not_contains"] not in out
    return ok, out.strip()[:400], int((time.time() - t0) * 1000)


def main():
    ap = argparse.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 82% confidence

Finding

Task JSON supplies a command directly to a shell running with the evaluator's privileges, without an enforced trust check or sandbox. Command execution is intentional for this evaluation workflow, but an attacker who can supply or modify a subsequently executed suite can run arbitrary commands, access local secrets, or alter files; a trusted, reviewed suite substantially reduces this risk.

Content

Scanner excerpt · scripts/eval_suite.py (reported line 27)May include surrounding context.

python

ok = os.path.exists(p)
        out = p if ok else "missing: " + p
    else:
        p = subprocess.run(t["cmd"], shell=True, text=True, capture_output=True,
                           timeout=t.get("timeout", 20), cwd=t.get("cwd"))
        out = (p.stdout or "") + (p.stderr or "")
        ok = p.returncode == 0