Security audit

Agent Guardrails

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with its guardrail purpose, but it needs Review because it installs persistent Git hooks, has a broken/overstated installer, and can print detected secrets into logs.

Review the install scripts before use, especially if your repository already has Git hooks. Do not rely on this as complete security enforcement until the missing pre-commit asset and overbroad claims are fixed. Avoid running check-secrets.sh in shared CI or agent logs unless it redacts matched values, and use the skill-update feedback loop only in repositories where persistent post-commit automation and skill auto-commit tooling are acceptable.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/check-secrets.sh:46
Finding: Secret scanner exposes detected credentials in terminal and CI logs
Content: View full analysis
Vulnerability Details

File Location: scripts/check-secrets.sh, lines 46-54
Vulnerability Type: Sensitive information exposure through diagnostic output
Risk Level: Medium

Vulnerable Code:

bash
for pattern in "${SECRET_PATTERNS[@]}"; do while IFS= read -r file; do [ -z "$file" ] && continue MATCH=$(grep -Pn "$pattern" "$file" 2>/dev/null || true) if [ -n "$MATCH" ]; then echo " 🚨 POSSIBLE SECRET in $file:" echo "$MATCH" | head -3 | sed 's/^/ /' ERRORS=$((ERRORS + 1)) fi done <<< "$FILES" done

Technical Analysis

grep -Pn returns the complete matching source line, including the value that triggered the secret-detection pattern. The script then prints up to three complete matches without redaction.

The configured patterns cover passwords, bearer tokens, API keys, GitHub tokens, Slack tokens, AWS access-key identifiers, and JWT-like values. Consequently, a security control intended to prevent credential disclosure can reproduce credentials in less-protected output channels.

This is particularly dangerous in automated environments where standard output is retained in CI logs, agent transcripts, build logs, terminal recordings, or debugging artifacts. The script does not transmit the values itself, but downstream log retention can materially expand their exposure.

Attack Path

A source or configuration file contains a hardcoded credential.

A developer, AI agent, pre-commit hook, or CI job invokes check-secrets.sh.

grep captures the entire credential-bearing line.

The script writes that line to standard output.

The execution environment stores or forwards the output.

A user with access to those logs obtains the credential and may use its associated permissions.

An attacker able to contribute repository content could also place a real or planted c ...[truncated 606 chars]
Remediation: View remediation
Remediation Suggestions

Never print the complete matching line or secret value.

Report only the file path, line number, and detected secret type.

If context is necessary, replace the matched value with [REDACTED] before output.

Prefer a scanner that returns structured metadata without returning secret contents.

Add tests verifying that representative token and password values never appear in standard output or standard error.

Document that historical CI logs generated by affected versions may contain secrets and should be reviewed, removed where possible, and followed by credential rotation.

Restrict CI log access and retention as defense in depth.

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/install-skill-feedback-loop.sh:192
Finding: Feedback-loop installer unconditionally overwrites the Git post-commit hook
Content: View full analysis
Vulnerability Details

File Location: scripts/install-skill-feedback-loop.sh, lines 192-202
Vulnerability Type: Unsafe Git hook replacement and persistent execution of mutable repository code
Risk Level: Medium

Vulnerable Code:

bash
# 3. Install git hook mkdir -p "$PROJECT_DIR/.git/hooks" cat > "$PROJECT_DIR/.git/hooks/post-commit" << 'HOOK_EOF' #!/bin/bash cd "$(git rev-parse --show-toplevel)" bash scripts/detect-enforcement-improvement.sh HOOK_EOF chmod +x "$PROJECT_DIR/.git/hooks/post-commit" echo "✅ Installed git post-commit hook"

Technical Analysis

The redirection operator truncates and replaces .git/hooks/post-commit without first checking whether a hook already exists. There is no backup, confirmation prompt, hook chaining, or hook-manager integration.

This can disable unrelated project automation or security controls already implemented by the existing hook. The replacement hook also invokes scripts/detect-enforcement-improvement.sh from the mutable working tree after every commit. Therefore, later changes to that script alter the command sequence executed by the local Git hook.

Installing a post-commit hook is explicitly declared by the Skill and is relevant to its feedback-loop functionality. The issue is not concealed persistence; it is unsafe replacement and execution design that exceeds the minimum modification necessary for interoperability with existing project hooks.

Attack Path

Existing-hook displacement path:

A target repository already has a post-commit hook used for security, auditing, synchronization, or validation.

A user runs install-skill-feedback-loop.sh.

The installer truncates the existing hook and writes its own content.

Future commits no longer invoke the displaced control.

Security or operational behavior previously enforced by that hook is silently lost.

Mutable-script execution path:

The ...[truncated 978 chars]
Remediation: View remediation
Remediation Suggestions

Detect an existing post-commit hook and refuse to overwrite it by default.

Require explicit user confirmation before modifying an existing hook.

Create a timestamped backup and restore it automatically if installation fails.

Prefer a standard hook manager or add a clearly delimited, idempotent call to the existing hook.

Provide an uninstall procedure that removes only this Skill's integration and restores prior behavior.

Avoid executing mutable working-tree scripts where practical. Resolve a trusted installer-managed script or verify the expected script before execution.

Validate that the target is an actual Git repository before creating .git/hooks.

Document the persistent per-commit execution behavior prominently before installation.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/install.sh:44
Finding: Missing pre-commit asset causes partial installation and absent advertised enforcement
Content: View full analysis
Vulnerability Details

File Location: scripts/install.sh, lines 44-51
Vulnerability Type: Fail-open packaging and installation integrity defect
Risk Level: Low

Vulnerable Code:

bash
if [ -f "$HOOKS_DIR/pre-commit" ]; then echo " ⚠️ Existing pre-commit hook found — backing up to pre-commit.bak" cp "$HOOKS_DIR/pre-commit" "$HOOKS_DIR/pre-commit.bak" fi cp "$SKILL_DIR/assets/pre-commit-hook" "$HOOKS_DIR/pre-commit" chmod +x "$HOOKS_DIR/pre-commit" echo " ✅ Pre-commit hook installed"

Technical Analysis

The audited package does not contain assets/pre-commit-hook, although install.sh and SKILL.md declare and reference it. Because the installer enables set -euo pipefail, the failed cp command terminates installation.

The failure occurs after validation scripts have already been copied into the target project and after an existing pre-commit hook may have been backed up. The installation is therefore non-atomic and leaves a partially modified target while failing to install the primary advertised pre-commit enforcement.

If a pre-existing hook is present, the failed copy does not itself remove that hook; however, the new Agent Guardrails hook is not installed.

Attack Path

This is principally a packaging and control-integrity failure rather than a direct attacker-driven code-execution vulnerability:

A user invokes the documented installation command.

The installer copies several scripts into the target project.

It attempts to copy the absent assets/pre-commit-hook.

The command fails and installation exits.

The advertised pre-commit secret and bypass checks are not installed.

The user may incorrectly assume that project guardrails are active unless the failure is investigated.

An attacker could benefit indirectly if users rely on the advertised enforcement and subsequently commit content that the missing hook was intended to block.

...[truncated 403 chars]
Remediation: View remediation
Remediation Suggestions

Include the declared assets/pre-commit-hook in the distributed package.

Validate every required source asset before modifying the target project.

Stage installation output in a temporary directory and apply changes atomically.

Implement rollback for any failure after target modification begins.

Add package-integrity tests that compare documented assets with shipped files.

Add an installation self-test that verifies the final hook exists, is executable, and invokes the expected checks.

Clearly report installation failure and avoid printing any completion message unless all required controls are active.

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The documentation explicitly instructs users to bypass the installed pre-commit guardrails with git commit --no-verify, which disables secret detection and policy checks at the exact point they are meant to enforce security. In a skill whose stated purpose is mechanical enforcement against agent bypasses, including a sanctioned bypass materially weakens the control and creates an easy path for accidental or intentional evasion.
Content: Scanner excerpt · CLAUDE_CODE_INSTALL.md (reported line 96)May include surrounding context.
Want to skip once?

bash
git commit --no-verify -m "message"

Need to update patterns?

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill markets itself as providing mechanical enforcement against agent bypass, secret exposure, deployment gaps, and registry controls, but the visible file only documents scripts/templates and indicates some controls require user customization. In a security tool, overstating the completeness of enforcement is dangerous because users may rely on protections that are only partial, placeholder-based, or not actually validated, leading to a false sense of security.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This skill markets itself as providing mechanical enforcement against agent bypass, secret exposure, deployment gaps, and registry controls, but the visible file only documents scripts/templates and indicates some controls require user customization. In a security tool, overstating the completeness of enforcement is dangerous because users may rely on protections that are only partial, placeholder-based, or not actually validated, leading to a false sense of security.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This skill markets itself as providing mechanical enforcement against agent bypass, secret exposure, deployment gaps, and registry controls, but the visible file only documents scripts/templates and indicates some controls require user customization. In a security tool, overstating the completeness of enforcement is dangerous because users may rely on protections that are only partial, placeholder-based, or not actually validated, leading to a false sense of security.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This skill markets itself as providing mechanical enforcement against agent bypass, secret exposure, deployment gaps, and registry controls, but the visible file only documents scripts/templates and indicates some controls require user customization. In a security tool, overstating the completeness of enforcement is dangerous because users may rely on protections that are only partial, placeholder-based, or not actually validated, leading to a false sense of security.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This skill markets itself as providing mechanical enforcement against agent bypass, secret exposure, deployment gaps, and registry controls, but the visible file only documents scripts/templates and indicates some controls require user customization. In a security tool, overstating the completeness of enforcement is dangerous because users may rely on protections that are only partial, placeholder-based, or not actually validated, leading to a false sense of security.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This skill markets itself as providing mechanical enforcement against agent bypass, secret exposure, deployment gaps, and registry controls, but the visible file only documents scripts/templates and indicates some controls require user customization. In a security tool, overstating the completeness of enforcement is dangerous because users may rely on protections that are only partial, placeholder-based, or not actually validated, leading to a false sense of security.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: This skill markets itself as providing mechanical enforcement against agent bypass, secret exposure, deployment gaps, and registry controls, but the visible file only documents scripts/templates and indicates some controls require user customization. In a security tool, overstating the completeness of enforcement is dangerous because users may rely on protections that are only partial, placeholder-based, or not actually validated, leading to a false sense of security.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This skill markets itself as providing mechanical enforcement against agent bypass, secret exposure, deployment gaps, and registry controls, but the visible file only documents scripts/templates and indicates some controls require user customization. In a security tool, overstating the completeness of enforcement is dangerous because users may rely on protections that are only partial, placeholder-based, or not actually validated, leading to a false sense of security.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · references/skill-update-feedback.md (reported line 13)May include surrounding context.
The Loop:

text
Project improvement → [Manual remember?] → Update skill → Other projects benefit ↑ Often breaks here

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: This section instructs maintainers to update the shared skill based on auto-detected project changes and then commit them, which creates a pathway for external project content to flow into the shared skill repository. Even though a human review step exists, the mechanism normalizes self-updating behavior and could let adversarial or low-quality project-specific logic be promoted into a broadly reused skill if review is rushed or weak.
Content: Scanner excerpt · references/skill-update-feedback.md (reported line 68)May include surrounding context.
Action needed:

Review improvement

Extract reusable parts

Update skills/agent-guardrails/

Commit

text

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check-secrets.sh (reported line 19)May include surrounding context.
sh
if [ -f "$TARGET" ]; then FILES="$TARGET" elif [ -d "$TARGET" ]; then FILES=$(find "$TARGET" -type f $ -name "*.py" -o -name "*.sh" -o -name "*.js" -o -name "*.ts" -o -name "*.yaml" -o -name "*.yml" -o -name "*.json" -o -name "*.env" -o -name "*.toml" -o -name "*.cfg" -o -name "*.ini" $ \ -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/__pycache__/*" -not -path "*/venv/*" 2>/dev/null || true) else echo "❌ Target not found: $TARGET"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check-secrets.sh (reported line 138)May include surrounding context.
sh
ERRORS=$((ERRORS + 1)) else MISSING_PATTERNS=() for pattern in '.env' '.env.*' '*.key' '*.pem' '*.p12' '*.pfx' 'id_rsa' 'id_ed25519' 'credentials.json'; do if ! grep -q "$pattern" .gitignore 2>/dev/null; then MISSING_PATTERNS+=("$pattern") fi

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check-secrets.sh (reported line 155)May include surrounding context.
sh
ERRORS=$((ERRORS + 1)) else MISSING_PATTERNS=() for pattern in '.env' '.env.*' '*.key' '*.pem' '*.p12' '*.pfx' 'id_rsa' 'id_ed25519' 'credentials.json'; do if ! grep -q "$pattern" .gitignore 2>/dev/null; then MISSING_PATTERNS+=("$pattern") fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check-secrets.sh (reported line 138)May include surrounding context.
sh
ERRORS=$((ERRORS + 1)) else MISSING_PATTERNS=() for pattern in '.env' '.env.*' '*.key' '*.pem' '*.p12' '*.pfx' 'id_rsa' 'id_ed25519' 'credentials.json'; do if ! grep -q "$pattern" .gitignore 2>/dev/null; then MISSING_PATTERNS+=("$pattern") fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/check-secrets.sh (reported line 155)May include surrounding context.
sh
ERRORS=$((ERRORS + 1)) else MISSING_PATTERNS=() for pattern in '.env' '.env.*' '*.key' '*.pem' '*.p12' '*.pfx' 'id_rsa' 'id_ed25519' 'credentials.json'; do if ! grep -q "$pattern" .gitignore 2>/dev/null; then MISSING_PATTERNS+=("$pattern") fi

Self-Modification

High

Category: Rogue Agent
Confidence: 92% confidence
Finding: This finding reflects logic that identifies a target skill for later update based on repository activity, establishing a self-referential maintenance channel. In the context of an agent skill, mechanisms that steer updates to the skill itself are dangerous because they can enable self-modification workflows that bypass normal change-control expectations.
Content: Scanner excerpt · scripts/install-skill-feedback-loop.sh (reported line 93)May include surrounding context.
sh
SKILL="agent-guardrails" fi echo "📝 Should update skill: $SKILL" # Create task TASK_FILE="$WORKSPACE/.pending-skill-updates.txt"

Self-Modification

High

Category: Rogue Agent
Confidence: 96% confidence
Finding: The generated task file explicitly instructs the operator to update the skill and then run an auto-commit script, which creates a guided self-modification workflow. Even if a human is nominally in the loop, this kind of embedded instruction can normalize and accelerate propagation of unreviewed changes into the skill package.
Content: Scanner excerpt · scripts/install-skill-feedback-loop.sh (reported line 110)May include surrounding context.
sh
Action needed: 1. Review the enforcement improvement 2. Extract reusable patterns 3. Update skills/$SKILL/ 4. Run: bash scripts/auto-commit-skill-updates.sh ---

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: The workflow documentation describes an automatic detection-to-task pipeline whose stated purpose is to drive skill updates from repository events. Documentation that operationalizes self-modification increases risk by institutionalizing the behavior and making it more likely to be used without careful scrutiny.
Content: Scanner excerpt · scripts/install-skill-feedback-loop.sh (reported line 214)May include surrounding context.
sh
1. **Detection (automatic):** Git post-commit hook detects enforcement improvements 2. **Task creation (automatic):** Creates task in `.pending-skill-updates.txt` 3. **Review (manual):** You review and update skill files 4. **Commit (semi-automatic):** Script commits with confirmation ## Usage

Self-Modification

High

Category: Rogue Agent
Confidence: 88% confidence
Finding: The installer’s final messaging tells the user that future commits will trigger detection and reminders to update skills, reinforcing the self-modification loop. In security-sensitive tooling, encouraging ongoing automated linkage between repository changes and skill updates enlarges the attack surface and can desensitize users to unusual update prompts.
Content: Scanner excerpt · scripts/install-skill-feedback-loop.sh (reported line 250)May include surrounding context.
sh
echo " - SKILL-UPDATE-WORKFLOW.md" echo "" echo "Next time you commit enforcement improvements," echo "the system will auto-detect and remind you to update skills."

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · PUBLISHING.md (reported line 172)May include surrounding context.
md
**Problem:** AI agents forget important steps, bypass standards, and lose knowledge between projects. **Solution:** Git hooks and automated checks that make it impossible to commit without verification. **4 Failure Modes Prevented:** 1. Reimplementation (bypass patterns)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/deployment-verification-guide.md (reported line 303)May include surrounding context.
md
**Problem:** AI agents forget important steps, bypass standards, and lose knowledge between projects. **Solution:** Git hooks and automated checks that make it impossible to commit without verification. **4 Failure Modes Prevented:** 1. Reimplementation (bypass patterns)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document directly instructs users to run an installation script that installs Git hooks, copies scripts, and modifies AGENTS.md, but it does not clearly warn that these actions will change repository behavior and developer workflow. In a security-sensitive skill, encouraging execution of a project-modifying script without an explicit change summary, consent step, or review guidance increases the risk of unintended code execution and persistence mechanisms being introduced.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 63)May include surrounding context.
Claude Code 用户：

bash
git clone https://github.com/jzOcb/agent-guardrails ~/.claude/skills/agent-guardrails cd 你的项目 && bash ~/.claude/skills/agent-guardrails/scripts/install.sh .

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/check-secrets.sh:90

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T07 · Tool Hijacking and Spoofing

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tool Parameter Abuse

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Self-Modification

Self-Modification

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Self-Modification

Self-Modification

Self-Modification

Self-Modification

Autonomous Decision Making

Autonomous Decision Making

Undeclared Tool Scope

Missing User Warnings

Skill Enumeration

Static analysis

Shell command execution detected (child_process).