Cms Project Governance

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:33 AM UTC
• Version: 2.2.1

Overview

This skill is a project-governance helper that writes limited project state files only under disclosed conditions and does not show deception, exfiltration, or unsafe persistence.

Install only if you want an agent to manage project-governance state and acceptance criteria. Review any proposed Active Packet, rebaseline, archive move, or multi-stage authorization before allowing writes, especially on production, credentials, paid resources, protected data, or destructive changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description includes very broad natural-language triggers such as 'scope creep', 'which project should I kill', and 'should I archive this', which can cause the skill to activate in ordinary project discussion rather than only when the user intentionally wants governance intervention. Over-broad invocation scope increases the chance of unintended authority capture, where the agent shifts from advisory behavior into workflow control or document-writing in contexts the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The instruction that the 'Developer proceeds without asking after each successful loop' explicitly authorizes continued autonomous action once an initial boundary is set. Even though the skill adds governance constraints, this still increases the risk of the agent making cumulative changes, expanding work within ambiguous bounds, or advancing toward acceptance states without fresh human confirmation at each step.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

For `acceptance_mode: Layered`:

- Controller may authorize several bounded stages in one Packet.
- Developer proceeds without asking after each successful loop.
- Stage Reviewer may pass a stage or return `Needs Fix` on the same Packet and Work Order.
- Standard/Full terminal state is `Ready for Independent Acceptance`.
- Independent QA receives criteria, diff, commands, raw evidence, limits, and target link, not the Developer's desired verdict.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This manifest file's default prompt describes a wide range of actions such as 'clarify the intended outcome', 'check alignment', and 'authorize bounded autonomy' without defining specific trigger conditions or exclusion boundaries. Those phrases are broad enough to overlap with common project-management requests, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The only documented command examples specify --language zh-CN, which imposes a specific locale in the natural-language instructions. The file does not indicate that language is optional, user-selectable, or justified by a region-specific requirement, which matches the policy concern for forced language or locale without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s natural-language instructions are fully constrained to Chinese, and there is no visible opt-in, alternative locale, or statement that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Lines L52-L53 show example invocations that force --language zh-CN. Under the policy, locale constraints should either offer a user choice or be clearly justified as region-specific; this file does not provide such justification or opt-in language.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SECURITY.md (reported line 5)May include surrounding context.

md

Version: 2.2.1

- This skill governs discovery, sizing, authorization, alignment, and acceptance. It must not silently expand scope, documents, or governance overhead beyond what the delivery class requires.
- Do not include `_meta.json` or `skill-card.md` in the published bundle; `.clawhubignore` excludes them.
- Never record personal contact data, counterparty names, customer addresses, phone numbers, or inspection and contract details in Active Packet, work orders, or QA decisions.
- Do not mark work accepted without the evidence its delivery class requires. Use `Accepted With Risk` only together with an unlock condition, an owner, and a date.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The instructions explicitly bind Chinese tasks to this zh-CN skill file and English tasks to a separate English file. This imposes a language/locale routing policy without stating that the user may opt into another language, which fits the language-choice policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file states that --write writes Docs/ACTIVE_PACKET.md, which affects user project data. While it limits the scope of the write, it does not present this as a caution or warning to the user, and the SQP-2 markdown criterion calls for warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This template is in a zh-CN path and contains Chinese instructions/comments alongside English headings, which implies a language-specific experience. There is no natural-language indication that users may choose another language or that the Chinese locale is intentionally required for a region-specific purpose.

Content

No source excerpt is available for this finding.