Security audit

DCL Provenance Tracker — Supply Chain & Version Drift Verifier

Security checks for vulnerabilities and agentic risk

Overview

This skill is an instruction-only checklist for comparing skill versions, with an optional and disclosed MCP lookup for previously created audit records.

Installers should understand that the core workflow asks users to paste both skill versions into the agent context for local analysis. Only configure or use the optional DCL Trust Oracle MCP server if you intend to perform the separate paid tx_hash verification step.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:157