Security audit

Agent Safety Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it overstates safety enforcement capabilities that its code does not actually provide.

Treat this as an alerting/log-analysis example, not as an enforceable guardrail. Before using it to protect real agents, add tested runtime enforcement for pause/kill, implement path and token-budget controls, and verify the missing dashboard/webhook features or remove those claims.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/monitor.py:164
Finding: Critical pause and kill actions are recorded but never enforced
Content: View full analysis
list[Alert]: alerts = [] # Rate limit check violation = self.rules.check_rate_limit(event.action, self.events) if violation: alerts.append(Alert("warn", "rate_limit", violation, event, "log")) # Tool allowlist if event.tool: violation = self.rules.check_tool_allowlist(event.tool) if violation: alerts.append(Alert("critical", "tool_block", violation, event, "pause")) self.paused_agents.add(event.agent_id) # Budget check self.total_cost += event.cost_usd violation = self.rules.check_budget(self.total_cost) if violation: alerts.append(Alert("fatal", "budget", violation, event, "kill")) # Scope check if event.target: violation = self.rules.check_scope(event.target) if violation: alerts.append(Alert("critical", "scope", violation, event, "pause")) self.paused_agents.add(event.agent_id) # Anomaly detection anomaly = self.detector.detect_anomaly(event, self.events) if anomaly: alerts.append(Alert("warn", "anomaly", anomaly, event, "log")) self.events.append(event) self.detector.update_baseline(self.events) self.alerts.extend(alerts) return alerts ``` ### Technical Analysis The monitor represents enforcement outcomes only as alert metadata. For tool and scope violations, it adds the agent identifier to `paused_agents`, but `process_event()` never checks that set before accepting later events. A fatal budget violation creates an alert whose `action_taken` value is `"kill"`, but it does not terminate, disable, reject, or otherwise constrain the offending agent. The implementation also lacks an enforcement callback or interface through which the mon ...[truncated 1381 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/monitor.py:51
Finding: Configured path-scope and hourly token restrictions are silently ignored
Content: View full analysis
Optional[str]: for pattern in self.blocked_targets: if pattern in target: return f"Blocked target: {target} matches {pattern}" return None ``` ```python # Budget check self.total_cost += event.cost_usd violation = self.rules.check_budget(self.total_cost) if violation: alerts.append(Alert("fatal", "budget", violation, event, "kill")) # Scope check if event.target: violation = self.rules.check_scope(event.target) if violation: alerts.append(Alert("critical", "scope", violation, event, "pause")) self.paused_agents.add(event.agent_id) # Anomaly detection anomaly = self.detector.detect_anomaly(event, self.events) if anomaly: alerts.append(Alert("warn", "anomaly", anomaly, event, "log")) ``` The documented configuration explicitly exposes these controls in `references/rules-reference.md:25-36`: ```yaml # Token budget per hour max_tokens_per_hour: 100000 # File scope restrictions scope: allowed_paths: - /home/agent/workspace blocked_paths: - /etc - /root - ~/.ssh ``` ### Technical Analysis `SafetyRules._load()` reads `max_tokens_per_hour` and `scope` into instance attributes, but no rule-checking method uses either value. `SafetyMonitor.process_event()` enforces only the cumulative dollar budget and calls `check_scope()`, which examines the separate `blocked_targets` list using substring matching. As a result: - `scope.allowed_paths` is never enforced. - `scope.blocked_pa ...[truncated 1792 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/rules-reference.md (reported line 22)May include surrounding context.
md
# Blocked target patterns blocked_targets: - /etc/shadow - .env - private_key - password

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/rules-reference.md (reported line 23)May include surrounding context.
md
# Blocked target patterns blocked_targets: - /etc/shadow - .env - private_key - password