War/Den Governance

• Outcome: Pass
• Latest audit: May 28, 2026 · 11:32 AM UTC
• Version: 1.0.0

Overview

This governance skill is coherent and purpose-aligned, but users should understand that it logs action context locally and can send action or memory data to cloud services when enterprise keys are configured.

Install only if you want a governance layer that evaluates and records agent actions. Keep community mode and WARDEN_FAIL_OPEN=false for local, fail-closed behavior; treat Sentinel_OS and EngramPort keys as secrets; and assume enterprise mode may transmit action details, memory content, metadata, and errors to those services.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises and documents capabilities that imply access to environment variables, outbound network services, and shell-related functionality, yet it declares no explicit permissions. This creates a trust and enforcement gap: users or the platform may assume the skill is lower privilege than it actually is, while the skill can still influence sensitive governance decisions, contact external services when API keys are present, and potentially participate in command-execution control paths.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide instructs users to send bot-identifying data to an external registration API, but it provides no notice about data disclosure, retention, or trust boundaries. In a governance/memory skill, encouraging cloud onboarding without privacy and transmission warnings can lead operators to expose metadata to third parties without informed consent or review.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The upgrade instructions tell users to place cloud service API keys into skill configuration, but they do not explain that these credentials grant access to governance and memory services and must be protected as secrets. This increases the risk of accidental key leakage through checked-in config files, logs, screenshots, or shared deployment manifests.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The manifest explicitly advertises cloud memory features via EngramPort/MandelDB but does not clearly warn that prompts, memories, or related agent context may be transmitted to an external service. In a governance and memory skill, users may reasonably assume local-only handling based on nearby 'community' claims, so the omission can lead to unintended disclosure of sensitive operational or personal data.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The manifest describes Sentinel_OS governance API usage without clearly stating that agent actions, prompts, policy-check metadata, or audit information may be sent off-device for evaluation. Because this skill hooks into before_action/after_action/on_error, the surrounding context increases sensitivity: externally transmitted data could include highly privileged action context and error details.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The test explicitly validates fail-open behavior: when the policy engine crashes, actions are still allowed if warden_fail_open=True. In a governance gateway, this creates a real security risk because an attacker or fault condition that disrupts policy evaluation can bypass enforcement entirely, and the surrounding skill context makes this more dangerous since the component is responsible for access-control and policy decisions.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code persists full `action.data` and `action.context` to a local SQLite database in plaintext, which can capture sensitive operational or user data without any minimization, redaction, encryption, or access-control measures in this component. In a governance/audit skill, these fields are especially likely to contain prompts, decisions, identifiers, or other sensitive metadata, so compromise of the local workstation, backup set, or home directory can expose materially sensitive information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: In enterprise mode, the client sends the full action payload to a remote Sentinel_OS endpoint, but this file provides no consent gate, redaction, or user-visible disclosure before transmission. Because governance actions may contain prompts, context, environment metadata, or other sensitive operational data, this can cause unanticipated data exfiltration to a third-party service, especially in an agent skill context where users may assume checks are local.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill persists full action, result, and context objects to governed memory, which can include prompts, tool inputs, secrets, file paths, tokens, and other sensitive runtime data. In a governance skill that runs on every action, this broad telemetry collection materially increases privacy and data-exposure risk, especially if the memory backend is remote or shared, and there is no evidence here of minimization, consent, or redaction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The error path writes action details and raw error information into memory, which can leak sensitive data through exception messages, stack-derived strings, or malformed input content. Error logs are often overlooked but can become a secondary exfiltration channel, and in this skill's context they are captured automatically for all failed actions without visible disclosure or sanitization.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.