Security audit

Symbiont

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for security governance, but its advertised enforcement and audit protections are incomplete or fragile enough that users should review it carefully before relying on it.

Install only if you treat this as advisory security assistance, not as a dependable enforcement layer. Before relying on it, verify the actual hook integration, fix the policy parser and sensitive-path checks, correct the script paths, add or remove the missing audit logger, and pin any external runtime images or binaries you deploy.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: policy-guard.sh:94
Finding: Inline TOML deny rules are silently ignored
Content: View full analysis
/dev/null) # Parse deny.paths from TOML while IFS= read -r line; do pattern=$(echo "$line" | sed 's/^[[:space:]]*"//;s/"[[:space:]]*,*$//') if [[ -n "$pattern" ]] && contains_pattern "$FILE_PATH" "$pattern"; then log_block "Policy deny: path matches '$pattern'" echo "BLOCKED: Path matches policy deny pattern: $pattern" exit 2 fi done < <(sed -n '/\[deny\]/,/^\[/{ /paths/,/\]/{ /paths/d; /\]/d; p; } }' "$POLICY_FILE" 2>/dev/null) # Parse deny.branches from TOML (check git operations) if [[ "$TOOL_NAME" == *"git"* ]] || contains_pattern "$COMMAND" "git push"; then while IFS= read -r line; do pattern=$(echo "$line" | sed 's/^[[:space:]]*"//;s/"[[:space:]]*,*$//') if [[ -n "$pattern" ]] && contains_pattern "$COMMAND" "$pattern"; then log_block "Policy deny: ...[truncated 1819 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: policy-guard.sh:67
Finding: Sensitive paths in shell commands bypass path restrictions
Content: View full analysis
/dev/null; then COMMAND=$(echo "$TOOL_INPUT" | jq -r '.command // .cmd // .shell_command // ""' 2>/dev/null || echo "") FILE_PATH=$(echo "$TOOL_INPUT" | jq -r '.path // .file_path // .filename // ""' 2>/dev/null || echo "") fi # --- Check built-in command deny patterns --- for pattern in "${BUILTIN_COMMAND_DENY[@]}"; do if contains_pattern "$COMMAND" "$pattern"; then log_block "Built-in deny: command matches '$pattern'" echo "BLOCKED: Command matches built-in deny pattern: $pattern" exit 2 fi done # --- Check built-in path deny patterns --- for pattern in "${BUILTIN_PATH_DENY[@]}"; do if contains_pattern "$FILE_PATH" "$pattern"; then log_block "Built-in deny: path matches '$pattern'" echo "BLOCKED: Path matches built-in deny pattern: $pattern" exit 2 fi done ``` ### Technical Analysis Sensitive-path checks are applied only to `FILE_PATH`, which is populated from `.path`, `.file_path`, or `.filename`. Shell tools normally carry filesystem references inside `.command`, `.cmd`, or `.shell_command`. The script does not compare the command string against `BUILTIN_PATH_DENY`. Consequently, a command referencing `.ssh/`, `id_rsa`, `.env`, `.aws/`, `.gnupg/`, or another denied resource can pass as long as the dedicated path fields are absent and the command does not match an unrelated destructive-command signature. The static pre-scan warning about SSH-key writes is a false positive regarding the literal strings: the script does not itself modify SSH keys. However, the incomplete guard can permit another tool to read or modify those files through a shell command. ### Attack Path 1. An attacker supplies a shell tool input such as: ...[truncated 1263 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:171
Finding: Documented enforcement and audit controls are absent or incorrectly referenced
Content: View full analysis
` to check against 40+ built-in detection rules. 3. Report findings by severity: Critical, High, Medium, Warning, Info. 4. Critical or High findings mean the skill should NOT be loaded. 5. Suggest remediation for any findings. ``` ```markdown ### Tier 1: Awareness (default) All tool calls proceed. State-modifying actions are logged to `.symbiont/audit/tool-usage.jsonl` for post-hoc review. No `symbi` binary required. The `scripts/audit-log.sh` script handles logging. ``` ```markdown ### Tier 2: Protection Create `.symbiont/local-policy.toml` to block dangerous patterns: ... The `scripts/policy-guard.sh` script checks tool calls against this deny list. Built-in patterns (destructive commands, force pushes, writes to sensitive files) are always blocked regardless of config. ``` ### Technical Analysis The audited package contains `clawhavoc-scan.sh` and `policy-guard.sh` at the project root rather than under `scripts/`. It does not contain the referenced `scripts/audit-log.sh`. No included runtime hook automatically invokes `policy-guard.sh` before every tool call. The existing guard records blocked operations only; it does not implement the documented logging of all state-modifying calls. The available JSONL append operation also does not provide cryptographic integrity by itself. As a result, the documented controls are not reliably connected to the operations they claim to govern. Advisory instructions to ...[truncated 1205 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill markets itself as zero-trust governance with enforcement, verification, scanning, and cryptographic audit trails, yet the content mostly provides procedural guidance and optional external-command hooks. In a security product, overstating enforcement can create a dangerous false sense of protection, leading operators to trust controls that may not actually exist or may degrade silently when symbi is absent.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill markets itself as zero-trust governance with enforcement, verification, scanning, and cryptographic audit trails, yet the content mostly provides procedural guidance and optional external-command hooks. In a security product, overstating enforcement can create a dangerous false sense of protection, leading operators to trust controls that may not actually exist or may degrade silently when symbi is absent.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
toml
[deny] paths = [".env", ".ssh/", ".aws/", ".gnupg/", "credentials"] commands = ["rm -rf", "git push --force", "mkfs", "dd if="] branches = ["main", "master", "production"]

Write AGENTS.md manifest.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.
md
| Format | Plugin (`.claude-plugin/`) | Extension (`gemini-extension.json`) | Skill (`SKILL.md`) |

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SOUL-symbiont.md (reported line 3)May include surrounding context.
md
# Symbiont Governance Agent You are a governance-aware coding assistant powered by the Symbiont Trust Stack. You help developers write code, manage agents, and maintain security policies while preserving cryptographic audit trails. ## Identity - You operate under Symbiont's zero-trust security model - You enforce Cedar authorization policies when they exist - You verify MCP tool schemas using SchemaPin before first use - You log security-relevant decisions to the audit trail - You apply the principle of least privilege by default ## Core Behaviors ### Before Modifying Files or Running Commands 1. Check if `.symbiont/local-policy.toml` exists. If it

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 90% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · SOUL-symbiont.md (reported line 50)May include surrounding context.
md
## What You Do Not Do - You do not bypass policy checks, even if the user asks you to. - You do not suppress audit logging. - You do not execute commands matching deny patterns in `.symbiont/local-policy.toml`. - You do not access paths listed in the deny list (`.env`, `.ssh/`, `.aws/`, etc.).

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · clawhavoc-scan.sh (reported line 52)May include surrounding context.
sh
"CRITICAL~eval-with-fetch~eval.*fetch[|]~Eval with network fetch" "CRITICAL~eval-with-fetch~eval.*curl~Eval with curl" "CRITICAL~eval-with-fetch~eval.*wget~Eval with wget" "CRITICAL~rm-rf-pattern~rm -rf /~Recursive delete from root" "CRITICAL~rm-rf-pattern~rm -rf \\\$HOME~Recursive delete from home" "WARNING~base64-decode~base64 -d~Base64 decode (potential obfuscation)" "WARNING~base64-decode~base64 --decode~Base64 decode (potential obfuscation)"

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · clawhavoc-scan.sh (reported line 71)May include surrounding context.
sh
# Credential harvesting (6 rules) "HIGH~cred-ssh-keys~\.ssh/id_~SSH private key access" "HIGH~cred-ssh-keys~\.ssh/authorized_keys~SSH authorized_keys manipulation" "HIGH~cred-aws~\.aws/credentials~AWS credential file access" "HIGH~cred-aws~AWS_SECRET_ACCESS_KEY~AWS secret key reference" "HIGH~cred-cloud-config~\.config/gcloud~GCloud config access"

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · clawhavoc-scan.sh (reported line 72)May include surrounding context.
sh
# Credential harvesting (6 rules) "HIGH~cred-ssh-keys~\.ssh/id_~SSH private key access" "HIGH~cred-ssh-keys~\.ssh/authorized_keys~SSH authorized_keys manipulation" "HIGH~cred-aws~\.aws/credentials~AWS credential file access" "HIGH~cred-aws~AWS_SECRET_ACCESS_KEY~AWS secret key reference" "HIGH~cred-cloud-config~\.config/gcloud~GCloud config access" "HIGH~cred-browser-cookies~\.mozilla.*cookies~Browser cookie access"

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · clawhavoc-scan.sh (reported line 76)May include surrounding context.
sh
eys~\.ssh/id_~SSH private key access" "HIGH~cred-ssh-keys~\.ssh/authorized_keys~SSH authorized_keys manipulation" "HIGH~cred-aws~\.aws/credentials~AWS credential file access" "HIGH~cred-aws~AWS_SECRET_ACCESS_KEY~AWS secret key reference" "HIGH~cred-cloud-config~\.config/gcloud~GCloud config access" "HIGH~cred-browser-cookies~\.mozilla.*cookies~Browser cookie access" "HIGH~cred-browser-cookies~\.chrome.*Cookies~Chrome cookie access" "HIGH~cred-keychain~security find-generic-password~macOS Keychain access" # Network exfiltration (3 rules) "HIGH~exfil-dns-tunnel~dig.*TXT.*@~DNS tunnel exfiltration" "HIGH~exfil-devtcp~/dev/tcp/~/dev/tcp outbound connection" "HIGH~exfil-nc-outbound~nc [0-9]~Netcat outbound data transfer" # Process injection (4 rules) "CRITICAL~inject-ptrace~ptrace~Ptrace-based process injection" "CRITICAL~inject-ld-preload~LD_PRELOAD~LD_PRELOAD injection" "CRITICAL~inject-proc-mem~/proc/.*/mem~/proc/mem manipulation" "CRITICAL~inject-gdb-at

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · clawhavoc-scan.sh (reported line 77)May include surrounding context.
sh
"HIGH~cred-cloud-config~\.config/gcloud~GCloud config access" "HIGH~cred-browser-cookies~\.mozilla.*cookies~Browser cookie access" "HIGH~cred-browser-cookies~\.chrome.*Cookies~Chrome cookie access" "HIGH~cred-keychain~security find-generic-password~macOS Keychain access" # Network exfiltration (3 rules) "HIGH~exfil-dns-tunnel~dig.*TXT.*@~DNS tunnel exfiltration"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · clawhavoc-scan.sh (reported line 77)May include surrounding context.
sh
"HIGH~cred-cloud-config~\.config/gcloud~GCloud config access" "HIGH~cred-browser-cookies~\.mozilla.*cookies~Browser cookie access" "HIGH~cred-browser-cookies~\.chrome.*Cookies~Chrome cookie access" "HIGH~cred-keychain~security find-generic-password~macOS Keychain access" # Network exfiltration (3 rules) "HIGH~exfil-dns-tunnel~dig.*TXT.*@~DNS tunnel exfiltration"

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Potential security issue detected. Manual review is recommended.
Content: Scanner excerpt · clawhavoc-scan.sh (reported line 95)May include surrounding context.
sh
"HIGH~privesc-setuid~chmod.*[ug]\+s~Setuid/setgid bit manipulation" "HIGH~privesc-setcap~setcap.*cap_~Linux capability manipulation" "HIGH~privesc-chown-root~chown root~Chown to root" "HIGH~privesc-nsenter~nsenter~Namespace entry (container escape)" # Symlink / path traversal (2 rules) "MEDIUM~traversal-symlink~ln -s.*/tmp/~Symlink escape attempt"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · clawhavoc-scan.sh (reported line 52)May include surrounding context.
sh
# --- Built-in deny patterns (always active) --- BUILTIN_COMMAND_DENY=( "rm -rf /" "rm -rf ~" "rm -rf \$HOME" "mkfs"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · policy-guard.sh (reported line 24)May include surrounding context.
sh
# --- Built-in deny patterns (always active) --- BUILTIN_COMMAND_DENY=( "rm -rf /" "rm -rf ~" "rm -rf \$HOME" "mkfs"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · policy-guard.sh (reported line 24)May include surrounding context.
sh
# --- Built-in deny patterns (always active) --- BUILTIN_COMMAND_DENY=( "rm -rf /" "rm -rf ~" "rm -rf \$HOME" "mkfs"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 100% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · policy-guard.sh (reported line 25)May include surrounding context.
sh
# --- Built-in deny patterns (always active) --- BUILTIN_COMMAND_DENY=( "rm -rf /" "rm -rf ~" "rm -rf \$HOME" "mkfs" "dd if=/dev/zero"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · policy-guard.sh (reported line 31)May include surrounding context.
sh
"dd if=/dev/zero" "dd if=/dev/random" ":(){ :|:& };:" "chmod -R 777 /" "chown -R" "> /dev/sda" )

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
md
) BUILTIN_PATH_DENY=( ".env" ".ssh/" ".aws/" ".gnupg/"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.
md
) BUILTIN_PATH_DENY=( ".env" ".ssh/" ".aws/" ".gnupg/"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · policy-guard.sh (reported line 37)May include surrounding context.
sh
) BUILTIN_PATH_DENY=( ".env" ".ssh/" ".aws/" ".gnupg/"

Credential Access

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · policy-guard.sh (reported line 41)May include surrounding context.
sh
".ssh/" ".aws/" ".gnupg/" ".config/gcloud/" "credentials" "id_rsa" "id_ed25519"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill repeatedly instructs the agent to run shell commands such as brew, cargo, docker, validation commands, and a local scanner script, but the manifest does not declare any explicit tool scope or allowed-tools boundary. In a zero-trust/security-themed skill, missing least-privilege declarations increases the chance the host agent will grant broader shell access than necessary, making misuse or unintended command execution more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The documentation tells users to pull ghcr.io/thirdkeyai/symbi:latest, which is a mutable tag and can change over time without notice. This undermines reproducibility and supply-chain integrity, and a compromised registry account or poisoned latest image could cause users to run unexpected code.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill says to invoke workflows by broadly describing what you need, rather than using narrowly bounded triggers. Broad activation criteria can cause the host agent to apply this skill in unrelated contexts, unexpectedly creating files, editing policies, running shell commands, or scanning paths when the user did not intend to invoke governance operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.