Security audit
Security checks for vulnerabilities and agentic risk
This guard skill is not clearly malicious, but it asks to control all skill script execution and has approval and logging weaknesses that users should review before installing.
Install only if you intentionally want a high-impact cross-skill wrapper and are comfortable reviewing its approvals and logs. Treat it as advisory security tooling, not a hard sandbox; avoid passing secrets in command arguments, protect or rotate audit logs, and do not let agents run the emergency reset or bypass procedures automatically.
SKILL.md:31Global Agent Execution Workflow Hijacking
scripts/guard-exec.sh:275Unauthenticated Confirmation Path Executes Arbitrary Scripts
scripts/guard-exec.sh:26Static Pattern Matching Does Not Enforce the Declared Security Policy
scripts/audit.sh:65Audit and Weekly Report Files Persist Secrets in Plaintext
scripts/promote-rule.sh:68Rule Promotion and Demotion Lack Verifiable Human Authorization
Referenced artifact was not completely inspected
- `guard-exec.sh`: read target scripts for static risk analysis before execution
Referenced artifact was not completely inspected
- `guard-exec.sh`: read target scripts for static risk analysis before execution
This runbook explicitly documents deletion of the audit log as part of a full reset. Even though framed as a manual emergency procedure, removing audit records destroys forensic evidence and weakens accountability if an operator or compromised agent follows the instructions.
cp -r skills/little-steve-agent-guard/rules /tmp/guard-rules-backup
# Reset
rm -f skills/little-steve-agent-guard/reports/audit-events.jsonl
rm -f skills/little-steve-agent-guard/reports/failure-dataset.json
rm -f skills/little-steve-agent-guard/rules/active/*.rule
rm -f skills/little-steve-agent-guard/rules/candidates/*.rule
Deleting the failure dataset removes historical security/training data that may be needed for post-incident analysis, regression testing, or detection tuning. In a guard skill, this makes future detection weaker and can conceal prior unsafe behavior.
rm -f skills/little-steve-agent-guard/reports/audit-events.jsonl rm -f skills/little-steve-agent-guard/reports/failure-dataset.json rm -f skills/little-steve-agent-guard/rules/active/.rule rm -f skills/little-steve-agent-guard/rules/candidates/.rule
The documented command removes all active rules, effectively disabling most guard protections. In context, this is more dangerous because the same runbook also describes bypassing the guard manually, so an attacker or negligent operator could neutralize defenses before executing risky actions.
rm -f skills/little-steve-agent-guard/reports/audit-events.jsonl rm -f skills/little-steve-agent-guard/reports/failure-dataset.json rm -f skills/little-steve-agent-guard/rules/active/.rule rm -f skills/little-steve-agent-guard/rules/candidates/.rule
Removing all candidate rules is destructive and can erase pending security improvements or review artifacts. While less severe than deleting active rules, it still impairs governance and can hide evidence of proposed controls or prior tuning efforts.
rm -f skills/little-steve-agent-guard/reports/audit-events.jsonl rm -f skills/little-steve-agent-guard/reports/failure-dataset.json rm -f skills/little-steve-agent-guard/rules/active/.rule rm -f skills/little-steve-agent-guard/rules/candidates/.rule
## Routine Operations
This duplicated Chinese reset command again instructs deletion of the audit log and failure dataset. The duplication increases exposure by making the destructive procedure accessible to a broader operator audience without additional safeguards or warnings.
rm -f reports/audit-events.jsonl reports/failure-dataset.json
rm -f rules/active/*.rule rules/candidates/*.rule
This duplicated command removes active and candidate rules from relative paths, which can disable protections and erase control artifacts. The relative-path form is especially risky because it depends on the current working directory and may affect unintended files if executed from the wrong location.
rm -f reports/audit-events.jsonl reports/failure-dataset.json
rm -f rules/active/*.rule rules/candidates/*.rule
The README explicitly states that low/medium-risk commands are auto-executed, which means the guard can authorize file- or system-affecting actions without a fresh user confirmation. In an agent/skill ecosystem where risk classification may be imperfect or bypassable, this creates a real safety gap: harmful commands mislabeled as medium could run automatically.
The documented behavior includes autonomous decision-making to auto-execute commands classified as low/medium risk. For a security control sitting between an agent and arbitrary skill scripts, delegating execution decisions to a heuristic classifier is dangerous because incorrect classification can directly permit unintended or destructive actions without human review.
Every execution is classified (low → medium → high → critical), logged, and gated:
- **Low/Medium**: auto-execute, logged
- **High**: block and ask you first
- **Critical**: reject outright
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Approval Levels
- **L1 (low/medium risk)**: Auto-execute, audit logged
- **L2 (dry-run)**: Preview without executing
- **L3 (high risk)**: Block and prompt user — output warning, wait for user to reply "确认" or "confirm"
- **BLOCK (critical)**: Reject entirely, no execution possible
The skill hard-codes specific approval phrases ("确认" or "confirm") as the only way to proceed after a high-risk prompt. This can create brittle approval handling, increase the chance of accidental approvals, and reduce user agency or localization flexibility, especially if upstream tooling treats those tokens as privileged control words.
The Chinese section repeats the same fixed-token approval requirement, requiring the user to reply with a specific phrase to authorize high-risk actions. This duplicates the same control weakness across locales and may encourage unsafe automation patterns that key off one exact string rather than a robust approval state.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
**Severity**: Low
**Status**: Design feedback
Skills like agent-guard are inherently cross-skill (read other skills' files for analysis).
The scanner flags this as "broad filesystem scope" even though it's declared and documented.
A "guard" or "meta-skill" category could let the scanner apply different evaluation criteria
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
audit_write(){
if [[ ! -f "$AUDIT_LOG" ]]; then
touch "$AUDIT_LOG"
chmod 600 "$AUDIT_LOG"
fi
echo "$1" >> "$AUDIT_LOG"
}
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
audit_write(){
if [[ ! -f "$AUDIT_LOG" ]]; then
touch "$AUDIT_LOG"
chmod 600 "$AUDIT_LOG"
fi
echo "$1" >> "$AUDIT_LOG"
}
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
# Dangerous binaries that indicate network or system-level access
NETWORK_BINS="curl wget nc ncat socat telnet ssh scp rsync ftp"
# Interpreters that can make runtime network calls or execute arbitrary code
DYNAMIC_EXEC_BINS="python python3 perl ruby node deno bun"
# chmod on own data files is safe; only flag chmod with dangerous targets
SYSTEM_BINS_CRITICAL="mkfs dd mount umount"
The prompt instructs the user to reply with either 确认 or confirm to proceed, hard-coding accepted language tokens rather than offering a locale choice or neutral confirmation mechanism. This is a natural-language policy issue because it imposes specific language forms without explicit user opt-in or documented locale constraints.
The confirm path executes any supplied script directly with bash "$script" "${pass_args[@]}" after only a prior out-of-band approval step, and it performs no re-validation of the script contents, path, or risk at the moment of execution. This creates a time-of-check/time-of-use gap: a script judged high-risk earlier can be modified or swapped before confirm, resulting in arbitrary code execution under a misleadingly approved context.
The file includes both English and Chinese versions of the same content rather than imposing a single required language. This does not constitute a natural-language policy violation under the stated rule.
The file presents a second full runbook section in Chinese, which imposes a specific language variant for part of the documentation without any stated user opt-in or explanation of locale requirements. The policy allows locale-specific content when clearly justified, but no such justification appears here.
The user-facing prompt explicitly requires replying with either '确认' or 'confirm' to proceed. This imposes a language-specific interaction constraint without offering broader language choice or documenting a justified locale limitation, which matches the natural-language policy violation criteria.