agent-guild

• Outcome: Review
• Latest audit: Sep 20, 2026 · 4:11 AM UTC
• Version: 3.9.0

Overview

Agent Guild is a coherent local shared-memory skill, but it centralizes cross-agent rules/skills and includes self-update/install paths that can change agent behavior from remote code.

Install only if you intentionally want multiple agents to share plaintext memory, rules, logs, and a common skill bus under ~/.agent-guild/. Avoid pipe-to-shell installers, keep auto-upgrade mode off unless you trust the release source, and review what will be symlinked or adopted before using --apply.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (103)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is about runtime shared-memory functionality for agents: recalling memory, writing shared identity/rules/focus, handoffs, logs, grooming, portability, and related commands. The supplied code does none of that. Instead, it is a release engineering / packaging utility that prepares a zip bundle of the skill for distribution and validates registry compatibility constraints. While packaging can be a supporting part of the overall project, this specific code chunk's behavior is materially different from the declared operational purpose of the skill itself. It neither reads nor writes the shared memory store, nor implements the described triggers or commands; its primary purpose is packaging and validation for publication.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger definition says any natural-language equivalent counts, which makes activation boundaries extremely loose for a skill that performs filesystem writes, cross-agent message routing, grooming, and optional network upgrade checks. Overbroad triggers increase the chance of unintended invocation and silent execution of mandatory side effects during ordinary conversation.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: Many listed triggers are common phrases such as 'you remember?', 'help me remember', 'what are we doing now', or 'cleanup', which are likely to occur in benign conversation. In this skill's context, accidental activation is more dangerous because the instructions mandate reading and writing persistent shared memory and may alter files automatically once triggered.

Ae1

High

• Category: analysis-evasion

Content

一份零依赖 Python CLI（`scripts/ag.py`，只用标准库）+ 一堆 Markdown/JSON。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

一份零依赖 Python CLI（`scripts/ag.py`，只用标准库）+ 一堆 Markdown/JSON。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Symlink-only: rm the link, never the target
[ -L "$SKILLS_ROOT/agent-guild" ] && rm "$SKILLS_ROOT/agent-guild"
# Copy: rm the directory you created (only if YOU created it)
[ -d "$SKILLS_ROOT/agent-guild" ] && rm -rf "$SKILLS_ROOT/agent-guild"
```

• Confidence: 97% confidence
• Finding: `rm "$SKILLS_ROOT/agent-guild"` deletes a path derived from a variable that may be misdetected, malformed, or manipulated. Even though intended for symlink rollback, the safety relies on surrounding assumptions rather than robust target validation, so an agent following this literally could remove the wrong file.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Symlink-only: rm the link, never the target
[ -L "$SKILLS_ROOT/agent-guild" ] && rm "$SKILLS_ROOT/agent-guild"
# Copy: rm the directory you created (only if YOU created it)
[ -d "$SKILLS_ROOT/agent-guild" ] && rm -rf "$SKILLS_ROOT/agent-guild"
```

Each retry: change exactly one variable (tier / target dir / manifest format) so you know which fix worked. The ladder is designed to be walked end to end before reporting back, so the user gets one clear outcome instead of a question per rung.

• Confidence: 99% confidence
• Finding: `rm -rf "$SKILLS_ROOT/agent-guild"` is highly dangerous because it performs recursive deletion on a variable-controlled path. If `SKILLS_ROOT` is wrong or attacker-influenced, this can destroy arbitrary directories and cause severe local data loss.

Chaining Abuse

High

• Category: Tool Misuse

Content

# Symlink-only: rm the link, never the target
[ -L "$SKILLS_ROOT/agent-guild" ] && rm "$SKILLS_ROOT/agent-guild"
# Copy: rm the directory you created (only if YOU created it)
[ -d "$SKILLS_ROOT/agent-guild" ] && rm -rf "$SKILLS_ROOT/agent-guild"
```

Each retry: change exactly one variable (tier / target dir / manifest format) so you know which fix worked. The ladder is designed to be walked end to end before reporting back, so the user gets one clear outcome instead of a question per rung.

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

TMP="$(mktemp -d)"
cp -R ~/.agent-guild/skills/agent-guild/. "$TMP/"
# Atomic-ish swap: rm old, mv new. (True atomicity needs same-FS.)
rm -rf "$SKILLS_ROOT/agent-guild"
mv "$TMP" "$SKILLS_ROOT/agent-guild"
```

• Confidence: 99% confidence
• Finding: The update fallback instructs `rm -rf "$SKILLS_ROOT/agent-guild"` before moving a replacement into place, again exposing destructive deletion through a variable path. This is especially risky in update flows because they may run repeatedly and automatically, magnifying the chance of catastrophic mistakes.

Chaining Abuse

High

• Category: Tool Misuse

Content

### macOS / Linux / WSL / Git Bash

```bash
curl -fsSL https://raw.githubusercontent.com/dqsjqian/agent-guild/main/scripts/install.sh | bash
```

### Windows（PowerShell）

• Confidence: 98% confidence
• Finding: Piping network-fetched content directly into bash is a classic command-chaining anti-pattern that removes any opportunity for inspection, integrity checking, or user confirmation. In the context of this skill, compromise would grant immediate shell execution and could alter shared memory, symlinks, tools, or other local files used by multiple agents.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
cd ~/.agent-guild && git pull   # （如果通过 git clone 装的）
# 或重新跑：
curl -fsSL https://raw.githubusercontent.com/dqsjqian/agent-guild/main/scripts/install.sh | bash
```

升级**永远不会**覆盖你的 `identity/` `rules/` `toolchain/`。只会更新协议骨架（`skills/`）。

• Confidence: 98% confidence
• Finding: The same chaining abuse appears in the upgrade instructions, meaning users are encouraged to repeatedly execute unaudited remote code over time. Recurrent updates through this mechanism substantially enlarge the attack window and make supply-chain compromise more damaging.

Chaining Abuse

High

• Category: Tool Misuse

Content

### macOS / Linux / WSL / Git Bash

```bash
curl -fsSL https://raw.githubusercontent.com/dqsjqian/agent-guild/main/scripts/install.sh | bash
```

### Windows (PowerShell)

• Confidence: 98% confidence
• Finding: Piping remote content directly into `bash` is a classic chaining-abuse pattern because it collapses fetch and execution into one unreviewed step. In this skill's context, that is more dangerous because the project is specifically aimed at integrating with multiple local AI agents and shared memory, so compromise could lead to broader local persistence or tampering across agent environments.

Credential Access

High

• Category: Privilege Escalation

Content

## What the skill deliberately does not do

- No daemon, no background scheduler, no autostart hook
- No credential reading, no keychain access, no `.env` parsing
- No network destination outside the version-check endpoints listed above
- No hard deletes, no `rm -rf` of user directories, no recursive delete of any
  path the user did not point at

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Either rely on the global installer:
curl -fsSL https://raw.githubusercontent.com/dqsjqian/agent-guild/main/install.sh | bash

# Or do it manually:
mkdir -p <user-extensible-skills-dir>

• Confidence: 98% confidence
• Finding: The `| bash` chain removes the opportunity for inspection and turns a network fetch directly into code execution, which is a classic high-risk pattern. In documentation intended for broad reuse across adapters, this can propagate unsafe installation practice widely and enable arbitrary shell execution on user machines.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Operation | Requires |
|---|---|
| `git push --force` | User explicit consent |
| `git reset --hard` | User explicit consent |
| Rewriting commit history | User explicit consent |
| `git branch -D` | User explicit consent |
| Recursive directory deletion | List affected files + confirm |

• Confidence: 65% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

## Examples (delete what you don't want)

1. **No silent assumptions** — if requirements are vague, ask before acting.
2. **No irreversible operations without confirmation** — `rm -rf`, `git push --force`, schema migrations etc. require explicit user approval.
3. **No network calls outside the allowlist** — list domains/services agents may contact.
4. **No code style changes without intent** — don't reformat files you're not actively modifying.
5. **No fabricated facts** — if you don't know, say so. Don't invent function signatures, library APIs, or quotes.

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

## Examples (delete what you don't want)

1. **No silent assumptions** — if requirements are vague, ask before acting.
2. **No irreversible operations without confirmation** — `rm -rf`, `git push --force`, schema migrations etc. require explicit user approval.
3. **No network calls outside the allowlist** — list domains/services agents may contact.
4. **No code style changes without intent** — don't reformat files you're not actively modifying.
5. **No fabricated facts** — if you don't know, say so. Don't invent function signatures, library APIs, or quotes.

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

# Universal Rules (template)

> Your hard rules. Every joined agent will read this and treat it as the highest-priority instruction. Edit freely.

## Examples (delete what you don't want)

1. **No silent assumptions** — if requirements are vague, ask before acting.
2. **No irreversible operations without confirmation** — `rm -rf`, `git push --force`, schema migrations etc. require explicit user approval.
3. **No network calls outside the allowlist** — list domains/services agents may contact.
4. **No code style changes without intent** — don't reformat files you're not actively modifying.
5. **No fabricated facts** — if you don't know, say so. Don't invent function signatures, library APIs, or quotes.
6. **Use trash, not rm** — for any file deletion, prefer the OS trash mechanism so the user can recover.

## Source

If you're an agent reading this for the first time and the f

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Credential Access

High

• Category: Privilege Escalation

Content

# runtime-internal bookkeeping, and the protocol's own skill.
EXCLUDE_NAMES = {
    ".venv", "venv", "node_modules", "__pycache__", ".git", ".DS_Store",
    ".env", "secrets", "cache", ".cache", "tmp", ".tmp", "dist", "build",
    "browsers",  # Playwright / Puppeteer browser binaries — rebuildable
    "agent-guild", "agent-commons",
    # runtime-internal metadata: owned by the host, not portable skills

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can automatically download and install remote code from external services, including on bootstrap via auto-upgrade mode. In a shared-memory skill whose purpose does not require remote code execution, this creates a major supply-chain risk: compromise of release infrastructure, DNS, transport, or repository content can result in arbitrary code being installed locally.

Chaining Abuse

High

• Category: Tool Misuse

Content

# Windows users: use install.ps1 instead.
#
# Usage:
#   curl -fsSL https://raw.githubusercontent.com/dqsjqian/agent-guild/main/install.sh | bash
# or:
#   bash install.sh
#

• Confidence: 98% confidence
• Finding: Piping curl directly into bash chains network retrieval and shell execution in a single step, eliminating any inspection point and maximizing the impact of a malicious or altered response. In this skill context, the danger is elevated because the installer writes persistent shared-agent state and executable tooling into the user's home directory, so compromise would have durable cross-agent effects.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

curl -fsSL "$REPO_RAW_URL/scripts/ag.py"                         -o "$CENTRAL/skills/agent-guild/scripts/ag.py"
  chmod +x "$CENTRAL/skills/agent-guild/scripts/ag.py" 2>/dev/null || true
  # Remove the pre-3.0 CLI name if upgrading from an older install
  rm -f "$CENTRAL/skills/agent-guild/scripts/ac.py" 2>/dev/null || true

  # User-owned templates (only seed if missing — never overwrite your edits)
  seed_if_missing() {

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs the agent to read environment variables, read and write files under the user's home directory, make network requests for upgrades, and invoke local commands, but it does not declare an explicit tool/permission scope. That creates a transparency and containment gap: a host or reviewer cannot easily enforce least privilege, and users may trigger significant side effects without a clear permission contract.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: Core operating instructions, triggers, and mandatory contract text are primarily presented in Chinese, while the file does not explicitly offer the user or agent a language/locale choice for these instructions. This can amount to forcing a specific language experience without opt-in.

Session Persistence

Medium

• Category: Rogue Agent

Content

`current-focus.md` is the "what's hot right now" board. When you start or
finish a major task, prepend your block (`ag focus` or manual Edit in place).
Never rewrite history other agents wrote.

## Capability 3 — Check inbox / send messages

• Confidence: 94% confidence
• Finding: The skill establishes persistent cross-session and cross-agent storage of focus state and shared context, causing information from one interaction to influence later ones. This persistence is security-relevant because it can retain sensitive user or task data in plaintext and expose it to other local agents, broadening the blast radius of prompt injection, mistakes, or overcollection.

Static analysis

No suspicious patterns detected.