governance-guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:08 AM UTC
• Version: 0.1.0

Overview

This skill is not visibly malicious, but its governance claims are weakened by an approval-bypass path and it stores full action details in a persistent plaintext audit log.

Review before installing. Use the full pipeline only, avoid relying on the standalone promote command until verdicts are authenticated or kept internal, and assume the witness log may contain sensitive prompts, paths, and tool parameters. If used, restrict filesystem permissions on ~/.openclaw/governance and avoid passing secrets through governed action parameters.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/governance.ts:128

Finding

Caller-Supplied Verdicts Can Bypass the Promotion Authorization Check

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/witness.ts:132

Finding

Complete Action Parameters and User Instructions Are Persisted in Plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (48)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Append-only witness logging and hash-chain verification can improve auditability, but they do not substitute for preventative authorization controls. If presented as evidence of governance enforcement, they may create a false sense of security while only detecting or recording actions after the fact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Append-only witness logging and hash-chain verification can improve auditability, but they do not substitute for preventative authorization controls. If presented as evidence of governance enforcement, they may create a false sense of security while only detecting or recording actions after the fact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Append-only witness logging and hash-chain verification can improve auditability, but they do not substitute for preventative authorization controls. If presented as evidence of governance enforcement, they may create a false sense of security while only detecting or recording actions after the fact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Append-only witness logging and hash-chain verification can improve auditability, but they do not substitute for preventative authorization controls. If presented as evidence of governance enforcement, they may create a false sense of security while only detecting or recording actions after the fact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Append-only witness logging and hash-chain verification can improve auditability, but they do not substitute for preventative authorization controls. If presented as evidence of governance enforcement, they may create a false sense of security while only detecting or recording actions after the fact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Append-only witness logging and hash-chain verification can improve auditability, but they do not substitute for preventative authorization controls. If presented as evidence of governance enforcement, they may create a false sense of security while only detecting or recording actions after the fact.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Append-only witness logging and hash-chain verification can improve auditability, but they do not substitute for preventative authorization controls. If presented as evidence of governance enforcement, they may create a false sense of security while only detecting or recording actions after the fact.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

npx tsx scripts/governance.ts pipeline '<intent-json>' --policy policies/standard.yaml

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

npx tsx scripts/governance.ts pipeline '<intent-json>' --policy policies/standard.yaml

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

npx tsx scripts/governance.ts pipeline '<intent-json>' --policy policies/standard.yaml

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

npx tsx scripts/governance.ts pipeline '<intent-json>' --policy policies/standard.yaml

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

npx tsx scripts/governance.ts pipeline '<intent-json>' --policy policies/standard.yaml

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · policies/minimal.yaml (reported line 7)May include surrounding context.

yaml

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · policies/minimal.yaml (reported line 27)May include surrounding context.

yaml

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · policies/standard.yaml (reported line 64)May include surrounding context.

yaml

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · policies/strict.yaml (reported line 45)May include surrounding context.

yaml

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/policy-schema.md (reported line 84)May include surrounding context.

md

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/fixtures/valid-policy.yaml (reported line 17)May include surrounding context.

yaml

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/governance.test.ts (reported line 71)May include surrounding context.

ts

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/policy-engine.test.ts (reported line 225)May include surrounding context.

ts

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/policy-engine.test.ts (reported line 230)May include surrounding context.

ts

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/policy-engine.test.ts (reported line 315)May include surrounding context.

ts

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/policy-engine.test.ts (reported line 318)May include surrounding context.

ts

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/yaml-parse.test.ts (reported line 141)May include surrounding context.

ts

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/yaml-parse.test.ts (reported line 147)May include surrounding context.

ts

rules:
  - name: block-credentials
    match:
      target_pattern: "**/*.env"
    verdict: deny
    reason: "Credential files are never accessible"

Static analysis

No suspicious patterns detected.