Sharedintellect Quorum

• Outcome: Review
• Latest audit: May 28, 2026 · 8:03 AM UTC
• Version: 0.7.3

Overview

Quorum is a disclosed validation tool, but users should treat it as a file-reading LLM workflow and not run it on private projects without understanding where analyzed content is sent.

Install only if you are comfortable running a Python package cloned from GitHub and sending selected project files to your configured LLM provider. Prefer reviewing the cloned repository or pinning a commit before use, avoid pointing batch mode at directories containing secrets, and use --no-learning for sensitive reviews.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f"Invoke-ScriptAnalyzer -Path '{escaped_path}' "
                "-Severity Warning,Error | ConvertTo-Json"
            )
            result = subprocess.run(
                ["pwsh", "-Command", ps_command],
                capture_output=True,
                text=True,

• Confidence: 84% confidence
• Finding: Although the outer process call is argv-based, it invokes PowerShell with a dynamically constructed -Command string. The code escapes single quotes in the path, which substantially reduces direct path-based injection, but passing a composed command string into an interpreter remains a riskier pattern and can become exploitable if future changes add more interpolated values or if PowerShell parsing edge cases are missed.

eval() call detected

High

• Category: Dangerous Code Execution

Content

import time
        time.sleep(1)
    elif mode == "dangerous":
        result = eval(data["value"])  # Security issue: eval on user input
    else:
        result = data["value"]

• Confidence: 99% confidence
• Finding: This is a true vulnerability: the code executes user-controlled input via eval(data["value"]) when mode is set to "dangerous". That enables arbitrary Python code execution in the current process, which can lead to full system compromise, data theft, file tampering, or lateral movement depending on runtime privileges.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the orchestrator to invoke a local Python script through Bash, which expands the execution surface from passive analysis into arbitrary local code execution. Even though the target script path is described as local and fixed relative to the skill, this still means using a shell-capable tool in a validation workflow, increasing risk if the script is modified, replaced, or if the surrounding environment is untrusted.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The instruction to report a PASS when all critics fail creates a fail-open validation path: users may interpret a completely unevaluated artifact as approved. In a security or quality gate context, this can enable unsafe code or configurations to be shipped because the system emits a success verdict despite total loss of assurance.

Context-Inappropriate Capability

High

• Confidence: 84% confidence
• Finding: The pipeline can automatically generate, apply, and persist LLM-produced modifications to analyzed artifacts, yet the revalidation only re-runs critics tied to prior blocking findings rather than performing full validation of the rewritten artifact. This creates a real integrity risk: unsafe or malicious changes could be introduced, appear 'improved' against a narrow subset of critics, and be saved as artifact-fixed.txt for downstream human or automated consumption.

Unvalidated Output Injection

High

• Category: Output Handling

Content

f"Invoke-ScriptAnalyzer -Path '{escaped_path}' "
                "-Severity Warning,Error | ConvertTo-Json"
            )
            result = subprocess.run(
                ["pwsh", "-Command", ps_command],
                capture_output=True,
                text=True,

• Confidence: 80% confidence
• Finding: The more relevant issue at this location is not output injection but interpreter command construction: a dynamic PowerShell command string is built and then executed with pwsh -Command. In a multi-agent validation framework that may process varied repository content and paths, this pattern is more sensitive because it expands the trust boundary to PowerShell parsing rules and increases the chance of future command-injection regressions.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.obfuscated_code (+1 more)

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: golden-test-set/tests/test_score.py:197

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: reference-implementation/quorum/critics/code_hygiene.py:136

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: reference-implementation/quorum/critics/security.py:216

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: reference-implementation/tests/fixtures/bad/code-god-function.py:34

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: reference-implementation/tests/test_models.py:389

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: reference-implementation/examples/sample-agent-config.yaml:71

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: reference-implementation/tests/fixtures/edge/with-api-key.txt:4

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: reference-implementation/tests/test_prescreen.py:117

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: reference-implementation/tests/test_security_accuracy.py:31

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: reference-implementation/tests/test_prescreen_properties.py:106

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: docs/architecture/IMPLEMENTATION.md:122

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: ports/claude-code/quorum-validation-skill/completeness-findings.md:50