workflow-guard-rails

• Outcome: Review
• Latest audit: Oct 23, 2026 · 6:09 AM UTC
• Version: 1.0.7

Overview

This safety skill needs review because setup can overwrite shared guidance and repeated failures can automatically become rules affecting future workflows.

Review the pinned companion before using it, preserve any existing playbook, and require human approval before generated rules become shared guidance. Decide which workflows should use these persistent rules and remove their memory and automation references when disabling the skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Downloading a supporting playbook could be a legitimate initialization detail, but this command writes directly to the exact file identified as authoritative. The supplied code contains no recurrence check, human-confirmation gate, or protection for existing guidance. Pinning the source commit limits upstream changes but does not enforce the declared controls on creating durable global guidance. The mismatch is this direct authoritative-file write, not merely the use of a network download or the absence of other guardrails from this excerpt.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The playbook path is related to the declared workflow, but directly replacing authoritative global guidance with remotely supplied content is materially different from the described staged, reviewed rule-accumulation process. Pinning the download to a commit limits upstream mutability; it does not establish human approval or preserve existing rules. The mismatch is the direct authoritative-file replacement, not simply the absence of the other guardrails in this partial chunk.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

md

## Drift monitoring (guard #6)

Do not judge compliance on a single run. Track the compliance rate across runs. A single deviation in one run is an early warning; a trend across runs is an escalation. Catching drift at the first deviation prevents the "looks fine every day, then suddenly collapses" failure path.

## Output format

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/guardian-patterns.md (reported line 85)May include surrounding context.

md

- Human confirmations (what was approved, by whom, when)
- Changes made

Do not judge compliance on a single run. Track the compliance rate **across runs**. A single deviation in one run is an early warning; a trend across runs is an escalation. Catching drift at the first deviation prevents the "looks fine every day, then suddenly collapses" path.

---

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

Creating the directory is benign; the surrounding installation procedure downloads external content directly into an authoritative, cross-workflow guidance file, overwriting any existing playbook. Commit pinning limits upstream mutation, but a non-empty file with an expected header does not establish that its instructions are trustworthy, and post-download checks cannot protect the previous file from replacement. Persistence outside the skill directory increases the reach and lifetime of any unsafe guidance.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

being renamed, removed, or republished. Fetch it once:

bash

mkdir -p ~/.workbuddy
# Pinned to commit d945aee0 — a mutable `main` URL is a supply-chain risk.
# To upgrade the playbook, deliberately move the pin to a new reviewed commit.
curl -o ~/.workbuddy/ERROR-PLAYBOOK.md \

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 82% confidence

Finding

Unapproved staging is not inherently unsafe, but the recurrence-only promotion path allows generated rules to become authoritative global guidance without human review. Repetition establishes frequency, not trustworthiness: an attacker able to influence recurring failure inputs could potentially poison guidance used by later workflows. The stated staging boundary reduces immediate exposure, but no provenance checks or restrictions on promoted rule content are specified.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

md

Explicit confirmation required before: first high-privilege tool use, any irreversible/external action, low-confidence results, and exhausted retry budget.

Rule accumulation (guard #7) is two-stage: confirmed failures are captured in the same run into `~/.workbuddy/ERROR-PLAYBOOK.staging.md`, with no approval gate on the capture (most failures surface during unattended runs where no human is present — that approval gate is why the rule library stayed empty for two months). A staged entry reaches the authoritative `ERROR-PLAYBOOK.md` only through the promotion gate: the failure recurs (count >= 2) or a human confirms it. A single unreviewed append never becomes durable global guidance.

## Output

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_zh.md (reported line 55)May include surrounding context.

所以它的位置必须能在本 skill 被改名、删除或重新发布后依然成立。取一次即可：

bash

mkdir -p ~/.workbuddy
# Pin 到 commit d945aee0 —— 可变的 main URL 是供应链风险。
# 要升级 playbook 时，人工审阅后把 pin 指向新的 commit。
curl -o ~/.workbuddy/ERROR-PLAYBOOK.md \

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/guardian-patterns.md (reported line 91)May include surrounding context.

md

## Pattern 7: Rule accumulation (guard #7)

When a failure mode is confirmed, capture it into the staging file (`~/.workbuddy/ERROR-PLAYBOOK.staging.md`) immediately — in the same run. Staging has no approval gate on purpose: waiting for a human is what starved the rule library for two months. But staging is not the authoritative store — a staged entry reaches `~/.workbuddy/ERROR-PLAYBOOK.md` only through the promotion gate: the failure recurs (count >= 2) or a human confirms the rule.

Recurring issues (e.g. a summary field that keeps exceeding length) should become permanent guards, not one-off fixes. The guardian's rule set grows from real failures, not from speculation — and from proven failures, not single unreviewed observations.

Static analysis

No suspicious patterns detected.