ClawHub
Back to skill

Security audit

agent-guild

Security checks for vulnerabilities and agentic risk

Overview

Agent Guild is a disclosed local shared-memory and task-handoff skill with high-impact local persistence, but the inspected artifacts keep those capabilities purpose-aligned and user-controlled.

Install only for assistants you trust with local files. Keep secrets out of the guild, review dry-run output before adopt/link-root, leave UPGRADE.md in mode=check or off unless you want automatic updates, and remember that private/memory directories are naming conventions, not encryption or access control.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (107)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents the skill as a runtime feature for shared memory, task handoff, recall, todos, retention, and safe local storage management. However, this code chunk does not implement those user-facing memory or handoff capabilities. Instead, it tests installation mechanics: creating a temporary HOME, mocking HTTPS release metadata and zip downloads, invoking install.sh/install.ps1, validating installed files/directories, preserving user files on reinstall, blocking tampered archives, and checking wrapper safety properties. These are related to packaging/distribution of the project, but they are materially different from the declared primary purpose and introduce undeclared capabilities around installer execution, download simulation, and release verification. Therefore this code chunk does not accurately match the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The supplied code chunk does not implement the declared agent-guild functionality. Instead, it is a narrow test script focused on filesystem link detection and safe handling of Windows junctions in the underlying ag module. While this may support the broader project by preventing self-move/deletion bugs, the code’s actual primary purpose is regression testing of link semantics, not shared agent memory, task handoff, checkpoint archiving, or todo/task metadata recovery. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description centers on runtime agent-memory features: shared identity/rules/long-term memory, task isolation, recall, handoff, todo listing, checkpointing, archival, and retention behavior. The supplied code chunk does none of that. Instead, it is test infrastructure for release packaging. Its primary purpose is to validate that a package script produces correct zip artifacts, excludes bytecode/cache files, preserves prior outputs on metadata validation failure, and handles checksum sidecars correctly. While version/frontmatter validation and archiving are tangentially related to release hygiene, they do not implement the described agent-guild memory/task-sharing behavior. Therefore this code chunk materially differs from the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description centers on agent memory sharing, task recovery, cross-agent messaging, and archival workflows. The actual code chunk does not implement or exercise those user-facing memory/task features. Instead, it tests a software upgrade security mechanism for the skill package itself, including digest verification, sidecar checksum handling, asset validation, secure extraction, downgrade rejection, and rollback safety. While version-checking and preservation of local data are loosely consistent with parts of the description, the primary purpose and concrete capabilities in this code are materially different and undeclared. Therefore this chunk is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/SECURITY.md (reported line 94)May include surrounding context.

md
## What the skill deliberately does not do

- No daemon, no background scheduler, no autostart hook
- No credential reading, no keychain access, no `.env` parsing
- No network destination outside the version-check endpoints listed above
- No hard deletes, no `rm -rf` of user directories, no recursive delete of any
  path the user did not point at

Memory Manipulation

High
Category
Memory Poisoning
Confidence
90% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/SPEC.md (reported line 37)May include surrounding context.

md
`handoff/active/` or `handoff/archive/`. The date/random portion is a permanent ID.
Renaming a title does not rename that directory. Metadata publishes an immutable
snapshot pointer; complete context and artifact manifests are committed together.
All mutations require ownership and an expected revision. A conflicting or corrupt
state MUST fail closed. Whole-package closure requires completion evidence; waiting
and blocked tasks remain active. Scripts are attachments and never auto-executed.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ag.py (reported line 444)May include surrounding context.

python
# runtime-internal bookkeeping, and the protocol's own skill.
EXCLUDE_NAMES = {
    ".venv", "venv", "node_modules", "__pycache__", ".git", ".DS_Store",
    ".env", "secrets", "cache", ".cache", "tmp", ".tmp", "dist", "build",
    "browsers",  # Playwright / Puppeteer browser binaries — rebuildable
    "agent-guild", "agent-commons",
    # runtime-internal metadata: owned by the host, not portable skills

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill contains a full remote code download and self-update pipeline that fetches release metadata and installs new code into the shared skill directory. Although there are substantial integrity checks, this still introduces remote code execution capability unrelated to the core memory/handoff purpose and significantly expands the attack surface through supply-chain compromise, repository compromise, or misconfiguration.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_concurrency.py (reported line 63)May include surrounding context.

python
self.root = Path(self.temp.name)
        self.guild = self.root / "guild"
        self.guild.mkdir()
        self.env = dict(os.environ, AGENT_GUILD_DIR=str(self.guild),
                        AG_HOST_ID="test-host", AG_AGENT="test-agent")

    def path(self, name):

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_handoff_e2e.py (reported line 22)May include surrounding context.

python
self.base = Path(self.temp.name).resolve()
        self.root = self.base / "guild"
        self.root.mkdir()
        self.env = dict(os.environ, AGENT_GUILD_DIR=str(self.root), AG_HOST_ID="test-host",
                        AG_AGENT="alice", PYTHONDONTWRITEBYTECODE="1")
        (self.root / "UPGRADE.md").write_text("mode = off\n", encoding="utf-8")
        self.call(["init", "alice"])

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_install.py (reported line 68)May include surrounding context.

python
urllib.request.build_opener = lambda *args, **kwargs: Opener()
''', encoding="utf-8")
        self.env = dict(os.environ, HOME=str(self.home), USERPROFILE=str(self.home),
                        AGENT_GUILD_DIR=str(self.central), AGENT_GUILD_PYTHON=sys.executable,
                        AGENT_GUILD_VERSION=self.version, AG_HOST_ID="install-test",
                        PYTHONDONTWRITEBYTECODE="1", PYTHONPATH=str(self.mock),

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_package.py (reported line 31)May include surrounding context.

python
".git", "__pycache__", ".DS_Store"))

    def package(self, output):
        env = dict(os.environ, HOME=str(self.base),
                   PATH=str(Path(sys.executable).parent) + os.pathsep + os.environ["PATH"],
                   PYTHONDONTWRITEBYTECODE="1")
        return subprocess.run(["bash", str(self.repo / "scripts/package.sh"),

Unvalidated Output Injection

High
Category
Output Handling
Confidence
95% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts/test_package.py (reported line 34)May include surrounding context.

python
env = dict(os.environ, HOME=str(self.base),
                   PATH=str(Path(sys.executable).parent) + os.pathsep + os.environ["PATH"],
                   PYTHONDONTWRITEBYTECODE="1")
        return subprocess.run(["bash", str(self.repo / "scripts/package.sh"),
                               str(output)], cwd=self.base, env=env,
                              capture_output=True, text=True)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_retention_e2e.py (reported line 22)May include surrounding context.

python
self.base = Path(self.temp.name).resolve()
        self.root = self.base / "guild"
        self.root.mkdir()
        self.env = dict(os.environ, AGENT_GUILD_DIR=str(self.root), AG_HOST_ID="acceptance-host",
                        AG_AGENT="alpha", PYTHONDONTWRITEBYTECODE="1")
        (self.root / "UPGRADE.md").write_text("mode = off\n")
        self.call(["init", "alpha"], decode=False)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_retention.py (reported line 551)May include surrounding context.

python
arguments = [sys.executable, "-c", worker, str(SCRIPTS), "checkpoint",
                     "--session", "session-one", "--agent", "alpha", *map(str, self.task_options(first))]
        processes = [subprocess.Popen(arguments, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                                      text=True, env=dict(os.environ)) for _ in range(2)]
        results = []
        with ThreadPoolExecutor(max_workers=2) as workers:
            pending = [workers.submit(process.communicate, "并发上下文" + str(number), timeout=30)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_tasks.py (reported line 396)May include surrounding context.

python
arguments = [sys.executable, "-c", worker, str(SCRIPTS), "checkpoint",
                     "--session", "session-one", "--agent", "alpha", *map(str, self.task_options(first))]
        processes = [subprocess.Popen(arguments, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                                      text=True, env=dict(os.environ)) for _ in range(2)]
        results = []
        with ThreadPoolExecutor(max_workers=2) as workers:
            pending = [workers.submit(process.communicate, "并发上下文" + str(number), timeout=30)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_tasks.py (reported line 676)May include surrounding context.

python
arguments = [sys.executable, "-c", worker, str(SCRIPTS), "checkpoint",
                     "--session", "session-one", "--agent", "alpha", *map(str, self.task_options(first))]
        processes = [subprocess.Popen(arguments, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
                                      text=True, env=dict(os.environ)) for _ in range(2)]
        results = []
        with ThreadPoolExecutor(max_workers=2) as workers:
            pending = [workers.submit(process.communicate, "并发上下文" + str(number), timeout=30)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_upgrade_security.py (reported line 405)May include surrounding context.

python
def test_https_origin_and_redirects_are_validated_before_download(self):
        for url in ("http://github.com/test", "https://evil.invalid/test",
                    "file:///etc/passwd", "https://user:pass@github.com/test"):
            with self.assertRaises(ValueError):
                self.ag._release_bytes(url, 100)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_EN.md (reported line 143)May include surrounding context.

md
- **Memory content:** identity, rules, and project files are user-owned. Assistants should record relevant summaries; keep passwords and tokens out of shared memory.
- **Network and updates:** installation downloads files. By default, `bootstrap` checks three public version sources at most once per device every 24 hours, without uploading memory content. In `UPGRADE.md`, `mode = check` reports updates, `mode = apply` downloads and installs them, and `mode = off` disables automatic checks. Manual `upgrade` remains available.
- **Context-only reads:** `bootstrap <agent> --no-maintenance` skips automatic grooming and upgrade checks for that invocation without changing saved policies.
- **Bounded history:** one configurable 1 GiB budget, with an 800 MiB target, covers archives, old checkpoints, logs and managed backups/recovery. Startup and finish run rate-limited checks, not destructive cleanup. Use `history status` and `history plan`, then explicitly approve an exact maintenance plan. If protected data or backup headroom blocks cleanup, new historical growth fails rather than bypassing the limit. Age thresholds create candidates, not deletion authority.
- **Sharing boundaries:** `memory/<agent>/` and `private/` are organizational conventions, not access controls or encryption. Programs with access to those files may still read them. Connect assistants you trust.
- **Models and backups:** Agent Guild stores its data files locally. Whether an assistant sends their contents to a model service depends on that assistant's runtime; your chosen backup or sync tool also has its own data handling.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly describes capabilities that touch local files, environment-derived paths, shell execution via python3, and optional network/version-check behavior, but it does not declare an explicit tool/permission scope in frontmatter. That creates an authorization transparency gap: a runtime or reviewer cannot easily constrain or audit what the skill is allowed to access, increasing the risk of overbroad file/system access if the skill is invoked in a permissive environment.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
72% confidence
Finding

The skill establishes durable, cross-session shared state under ~/.agent-guild/ and seeds identity, rules, logs, handoff data, and memory. Even though this is the skill's stated purpose, persistent multi-agent memory increases the blast radius of prompt-injected or sensitive data because information can survive sessions and be surfaced to other joined agents later.

Content

Scanner excerpt · manifest.json (reported line 98)May include surrounding context.

json
},
  "actions": {
    "init": {
      "summary": "Bootstrap ~/.agent-guild/ when it does not exist: create the full protocol + convention skeleton (identity/rules/toolchain/projects/handoff/log/skills/skills_data/mcp/plugins/tools/memory), seed placeholder context files and registry.json, and install the agent-guild skill itself into skills/agent-guild/. Idempotent — safe to re-run every session; never clobbers existing data, only fills gaps.",
      "cmd": "python3 <skill_dir>/scripts/ag.py init <agent>",
      "write_mode": "create_if_missing"
    },

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · manifest.json (reported line 228)May include surrounding context.

json
{
      "tier": "readonly",
      "last_resort": false,
      "description": "Direct protocol access without local skill installation, also suitable for an initial memory trial. Read the central skill each session; report that automatic runtime triggering is unverified or unavailable. Write only where the runtime and user permit."
    }
  ],
  "guidance_for_joined_agents": {

Session Persistence

Medium
Category
Rogue Agent
Confidence
74% confidence
Finding

The skill explicitly supports persistent task state and later resumption across conversations via session IDs, task packages, checkpoints, and resume operations. In a local-first shared-memory skill, this can cause unintended carryover of prior context, including sensitive or stale data, if session identifiers are reused, guessed, mishandled, or resumed without strong user confirmation.

Content

Scanner excerpt · references/CAPABILITIES.md (reported line 73)May include surrounding context.

bash
# Current request only. Context comes from stdin, not a guessed older task.
ag task create --title "Example task" --project demo --session SID --agent alice --summary "Next action"
ag task list --session SID --agent bob
# After the user picks a number from the returned list_id:
ag task resume --session SID --agent bob --list LIST_ID --number 2

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This reference file mixes English with extended Chinese-only sections for core operational guidance, including cross-agent memory and learning-ledger procedures. Because the file does not offer users or agents a language/locale choice and does not justify the constraint as region-specific, it creates a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The portability section contains operational instructions and scope definitions only in Chinese. Forcing a specific language for part of the skill's required behavior without user choice or a documented regional justification violates the natural-language policy criterion.

Content

No source excerpt is available for this finding.