DCL Policy Enforcer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.6

Overview

The skill is transparent about being a paid remote policy-check service, but it can send full agent outputs to a third party and trigger wallet payments without clear per-call consent or redaction-first controls.

Use the free checklist or redact secrets and personal data before live checks unless you are comfortable sending the evaluated output to Fronesis Labs. Configure wallet budgets, spending limits, or manual approval for x402 payments before enabling the live MCP server.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Unredacted Agent Output Is Sent to a Third-Party Service Before PII Filtering

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–105, 125–126, 182–188, 202–212, and 226–229
Vulnerability Type: Sensitive-data exposure through insecure processing order
Risk Level: Medium

Vulnerable Code Snippets

The documented configuration connects the agent to an external MCP service:

json

{
  "mcpServers": {
    "dcl-trust-oracle": {
      "url": "https://mcp.fronesislabs.com/mcp"
    }
  }
}

The complete agent output is supplied to the remote evaluation tool:

python

result = dcl_evaluate_jailbreak(
    response=agent_output,
    agent_id="my-agent-01",
)

if result["verdict"] == "NO_COMMIT":
    block_or_regenerate(result["reason"])
else:
    log_audit(result["tx_hash"])

The skill only promises that raw responses are not persisted:

text

Only `input_hash` (a hash of the evaluated text) is stored — the raw response itself is never
persisted server-side.

The documented pipeline places PII redaction after the external policy evaluation:

text

DCL Policy Enforcer        ← this skill (live paid check, or free checklist)
        │ COMMIT
        ▼
DCL Sentinel Trace         ← PII redaction

The same document recognizes that evaluated output can contain sensitive values:

text

### PII Surface Patterns

- [ ] Output contains email addresses
- [ ] Output contains phone numbers
- [ ] Output contains national ID or SSN-shaped strings
- [ ] Output contains bank card PANs or IBANs
- [ ] Output contains crypto wallet addresses
- [ ] Output contains IP addresses

Technical Analysis

The live evaluation accepts agent_output as its response argument. Consequently, the external service must receive and process the plaintext output before it can compute a verdict and input hash. The statement that raw text is not persisted does not mean that raw text is not transmitted, temporarily buffered, logged by ...[truncated 2369 chars]

Remediation

View remediation

Remediation Suggestions

1. Redact before transmission: Move PII, credential, and secret detection ahead of every live Policy Enforcer call. Only sanitized content should be supplied as response.

2. Default to local processing: Use the free instruction-only checklist by default. Require an explicit opt-in before sending text to the external MCP endpoint.

3. Obtain informed consent: Clearly disclose that the complete response, rather than only its hash, must be transmitted for evaluation. Obtain consent before handling personal, medical, financial, or otherwise confidential content.

4. Minimize submitted data: Send only the smallest text segment required for the selected policy check. Remove metadata and context that are not necessary for evaluation.

5. Block prohibited data classes: Refuse live evaluation when the response contains credentials, national identifiers, payment-card data, medical records, or other restricted information unless an approved data-processing agreement and lawful basis exist.

6. Define verifiable processing controls: Document transport security, transient buffering, server and proxy logging, retention periods, subprocessors, geographic processing locations, incident handling, and deletion guarantees.

7. Secure failure behavior: If redaction fails or the content cannot be classified safely, fail closed and use the local checklist rather than forwarding the original response.

8. Control wallet spending: Require per-call authorization or enforce strict budgets, rate limits, and maximum transaction values for x402 payments.

9. Update the documented pipeline: Place PII redaction and secret scanning before all external checks:

   text

   LLM output
       → PII and secret redaction
       → explicit transmission approval
       → DCL Policy Enforcer
       → delivery
   

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

### Data Handling Patterns

- [ ] Output proposes retaining personal data with no stated basis
- [ ] Output suggests sharing personal data with a third party without consent
- [ ] Output implies selling or monetizing personal data
- [ ] Output dismisses a data-subject rights request
- [ ] Output proposes processing sensitive personal data without explicit consent