Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local scanner for repository agent configuration files and does not show hidden execution, persistence, mutation, or exfiltration behavior.
Install this only if you are comfortable letting it read agent-related project configuration, including MCP config files that may contain server details or inline secrets. It appears designed for local review and reporting; review findings before acting on them because regex scanners can produce false positives.
The skill claims to scan repository agent configuration files, but the referenced scanner behavior reportedly extends into broader code auditing, secret detection, package analysis, and network-based verification. That scope expansion materially changes the trust boundary: a user invoking a narrowly scoped config scanner may unknowingly permit broader repository inspection and outbound dependency lookups.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
- `.claude/settings.json` -- hook configs (auto-approve, stop loops, env persistence)
- `.claude/skills/` -- all SKILL.md files (hidden comments, curl|bash, persistence triggers)
- `.mcp.json` -- MCP server configs (unknown URLs, env var expansion, broad tools)
- `CLAUDE.md` / `.claude/CLAUDE.md` -- instruction injection in project config
## Output
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Advisory hooks
This repository includes PreToolUse hooks in `.claude/settings.json` that warn on
dangerous Bash commands (pipe-to-shell, `rm -rf /`, `chmod 777`, eval with variables,
base64-to-execution) and sensitive file writes (`.ssh/`, `.aws/`, `.gnupg/`, shell
profiles, `settings.json`).
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
## Advisory hooks
This repository includes PreToolUse hooks in `.claude/settings.json` that warn on
dangerous Bash commands (pipe-to-shell, `rm -rf /`, `chmod 777`, eval with variables,
base64-to-execution) and sensitive file writes (`.ssh/`, `.aws/`, `.gnupg/`, shell
profiles, `settings.json`).
This file contains live network capability through package-registry verification using urllib to contact PyPI and npm, but the skill metadata says the skill scans repository agent configuration files. That mismatch expands the operational surface and can surprise users or violate least-privilege expectations, even though the network use is not overtly malicious here.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
"""
Shared pattern database for AI Agent Security skill suite.
Central registry of detection patterns derived from research notes 01-18
and examples 01-04. Used by vet-repo, scan-skill, and audit-code skills.
"""
import re
from dataclasses import dataclass, field
from enum import Enum
from typing import Optional
class Severity(Enum):
CRITICAL = "CRITICAL"
HIGH = "HIGH"
MEDIUM = "MEDIUM"
LOW = "LOW"
INFO = "INFO"
class Category(Enum):
SKILL_INJECTION = "skill_injection"
HOOK_ABUSE = "hook_abuse"
MCP_CONFIG = "mcp_config"
SECRETS = "secrets"
DANGEROUS_CALLS = "dangerous_calls"
EXFILTRATION = "exfiltration"
EN
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
_obfuscation"
INSTRUCTION_OVERRIDE = "instruction_override"
SUPPLY_CHAIN = "supply_chain"
FILE_PERMISSIONS = "file_permissions"
CODE_BEFORE_REVIEW = "code_before_review"
CONFIG_BACKDOOR = "config_backdoor"
MEMORY_CORRUPTION = "memory_corruption"
CONFUSED_DELEGATION = "confused_delegation"
PERSISTENCE = "persistence"
@dataclass
class Pattern:
name: str
pattern: str
severity: Severity
description: str
category: Category
compiled: Optional[re.Pattern] = field(default=None, repr=False)
def __post_init__(self) -> None:
self.compiled = re.compile(self.pattern, re.IGNORECASE)
@dataclass
class Finding:
pattern_name: str
severity: Severity
category: Category
description: str
file_path: str
line_number: int
matched_text: str
context: str = ""
# -- Skill Injection Patterns --
Skill_Injection_Patterns: list[Pattern] = [
Pattern(
name="html_comment_with_commands",
pattern=r"<!--[\s\S]*?(curl|wget|bash|sh|exec|eval|system|python|node|perl)[\s\S]*?-->",
severit
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
name="github_pat",
pattern=r"gh[pso]_[a-zA-Z0-9]{36,}",
severity=Severity.CRITICAL,
description="GitHub personal access token detected",
category=Category.SECRETS,
),
Pattern(
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
name="github_pat",
pattern=r"gh[pso]_[a-zA-Z0-9]{36,}",
severity=Severity.CRITICAL,
description="GitHub personal access token detected",
category=Category.SECRETS,
),
Pattern(
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
name="python_marshal_loads",
pattern=r"marshal\.loads\s*\(",
severity=Severity.MEDIUM,
description="marshal.loads() -- deserializes Python code objects, rarely needed in normal code",
category=Category.DANGEROUS_CALLS,
),
# Java / .NET / PowerShell
Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
name="python_marshal_loads",
pattern=r"marshal\.loads\s*\(",
severity=Severity.MEDIUM,
description="marshal.loads() -- deserializes Python code objects, rarely needed in normal code",
category=Category.DANGEROUS_CALLS,
),
# Java / .NET / PowerShell
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
TUP|NODE_OPTIONS|GIT_SSH_COMMAND|PYTHONPATH|RUBYOPT|JAVA_TOOL_OPTIONS)\s*=",
severity=Severity.HIGH,
description="Environment variable hijack -- can intercept library loads, force code execution, or redirect commands",
category=Category.DANGEROUS_CALLS,
),
# Credential store access
Pattern(
name="crypto_wallet_browser_creds",
pattern=r"(Exodus|MetaMask|Electrum|wallet\.dat|Login Data|Cookies|Web Data|chrome.*User Data|\.mozilla/firefox)",
severity=Severity.HIGH,
description="Crypto wallet or browser credential store access -- credential harvesting indicator",
category=Category.DANGEROUS_CALLS,
),
]
# -- Exfiltration Patterns --
Exfiltration_Patterns: list[Pattern] = [
Pattern(
name="curl_post_sensitive_file",
pattern=r"curl\s+[^\n]*(-d|--data)\s+[^\n]*(cat|<)\s+[^\n]*(\.ssh|\.aws|\.gnupg|\.kube|\.env|credentials|id_rsa|private)",
severity=Severity.CRITICAL,
description="Exfiltration -- sensitive file contents sent via curl POST",
category=Category.EXFI
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="sensitive_file_read",
pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
severity=Severity.HIGH,
description="Reading sensitive credential files",
category=Category.EXFILTRATION,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="sensitive_file_read",
pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
severity=Severity.HIGH,
description="Reading sensitive credential files",
category=Category.EXFILTRATION,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="sensitive_file_read",
pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
severity=Severity.HIGH,
description="Reading sensitive credential files",
category=Category.EXFILTRATION,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="sensitive_file_read",
pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
severity=Severity.HIGH,
description="Reading sensitive credential files",
category=Category.EXFILTRATION,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="sensitive_file_read",
pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
severity=Severity.HIGH,
description="Reading sensitive credential files",
category=Category.EXFILTRATION,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="sensitive_file_read",
pattern=r"(cat|head|tail|less|more|type)\s+[^\n]*(\.ssh/id_rsa|\.aws/credentials|\.gnupg/|\.kube/config|/etc/shadow|/etc/passwd)",
severity=Severity.HIGH,
description="Reading sensitive credential files",
category=Category.EXFILTRATION,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="credential_path_access",
pattern=r"(~/\.ssh/|~/\.aws/|~/\.gnupg/|~/\.kube/|~/\.netrc|~/\.docker/config\.json|~/\.npmrc|~/\.git-credentials|~/\.pypirc|/etc/shadow)",
severity=Severity.MEDIUM,
description="Reference to sensitive credential file paths",
category=Category.EXFILTRATION,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="credential_path_access",
pattern=r"(~/\.ssh/|~/\.aws/|~/\.gnupg/|~/\.kube/|~/\.netrc|~/\.docker/config\.json|~/\.npmrc|~/\.git-credentials|~/\.pypirc|/etc/shadow)",
severity=Severity.MEDIUM,
description="Reference to sensitive credential file paths",
category=Category.EXFILTRATION,
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
),
Pattern(
name="credential_path_access",
pattern=r"(~/\.ssh/|~/\.aws/|~/\.gnupg/|~/\.kube/|~/\.netrc|~/\.docker/config\.json|~/\.npmrc|~/\.git-credentials|~/\.pypirc|/etc/shadow)",
severity=Severity.MEDIUM,
description="Reference to sensitive credential file paths",
category=Category.EXFILTRATION,
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
name="authority_impersonation",
pattern=r"(i\s+am\s+(the|a)\s+(developer|admin|owner|maintainer|engineer)|authorized\s+by\s+(the\s+)?(team|admin|management)|admin\s+override|security\s+team\s+approv)",
severity=Severity.MEDIUM,
description="Authority impersonation -- claims elevated identity to bypass safety restrictions",
category=Category.INSTRUCTION_OVERRIDE,
),
Pattern(
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
name="authority_impersonation",
pattern=r"(i\s+am\s+(the|a)\s+(developer|admin|owner|maintainer|engineer)|authorized\s+by\s+(the\s+)?(team|admin|management)|admin\s+override|security\s+team\s+approv)",
severity=Severity.MEDIUM,
description="Authority impersonation -- claims elevated identity to bypass safety restrictions",
category=Category.INSTRUCTION_OVERRIDE,
),
Pattern(
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
name="authority_impersonation",
pattern=r"(i\s+am\s+(the|a)\s+(developer|admin|owner|maintainer|engineer)|authorized\s+by\s+(the\s+)?(team|admin|management)|admin\s+override|security\s+team\s+approv)",
severity=Severity.MEDIUM,
description="Authority impersonation -- claims elevated identity to bypass safety restrictions",
category=Category.INSTRUCTION_OVERRIDE,
),
Pattern(
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
name="authority_impersonation",
pattern=r"(i\s+am\s+(the|a)\s+(developer|admin|owner|maintainer|engineer)|authorized\s+by\s+(the\s+)?(team|admin|management)|admin\s+override|security\s+team\s+approv)",
severity=Severity.MEDIUM,
description="Authority impersonation -- claims elevated identity to bypass safety restrictions",
category=Category.INSTRUCTION_OVERRIDE,
),
Pattern(
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution