Security audit

consensus-agent-action-guard

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed action-governance guard, but its high-impact decisions can be driven by weakly validated caller input.

Review this carefully before installing in any automation path that can delete data, post publicly, send messages, or mutate business systems. It should not be the sole authority for high-risk execution unless external votes are authenticated and schema-validated, action metadata is enforced conservatively, and installs are locked with the committed package-lock file.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: src/index.mjs:68
Finding: Caller-Controlled External Votes Can Bypass Local Safety Evaluation
Content: View full analysis
({ persona_id:`default-${n}`, name:`Default Persona ${n}`, reputation:0.5 })) }; } const votes = externalMode ? input.external_votes : makeVotes(personaSet, input.proposed_action, input.constraints || {}); const ag = aggregateVotes(votes, { method:'WEIGHTED_APPROVAL_VOTE', approve_threshold:0.7 }); ``` ### Technical Analysis When `mode` is `external_agent`, the caller-provided `external_votes` array is passed directly to `aggregateVotes()`. Local validation only confirms that the value is an array. The code does not enforce a vote schema, authenticate voter identities, verify signatures, restrict voters to an authorized set, or establish an independent quorum. External mode also bypasses `makeVotes()`, which is where this package applies its local checks for high-risk irreversible actions, sensitive-data flags, and human-confirmation requirements. Consequently, a party capab ...[truncated 1468 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/index.mjs:30
Finding: Security Decisions Trust Incomplete and Weakly Typed Action Metadata
Content: View full analysis
({board_id:b,error:{code:c,message:m,details:d}}); function validate(input){ if(!input||typeof input!=='object'||Array.isArray(input)) return 'input must be object'; let e=rejectUnknown(input,TOP,'input'); if(e) return e; if(typeof input.board_id!=='string' || !input.board_id.trim()) return 'board_id is required'; if(!input.proposed_action||typeof input.proposed_action!=='object'||Array.isArray(input.proposed_action)) return 'proposed_action is required'; e=rejectUnknown(input.proposed_action,ACTION,'proposed_action'); if(e) return e; if(input.constraints!==undefined){ if(typeof input.constraints!=='object'||Array.isArray(input.constraints)) return 'constraints must be object'; e=rejectUnknown(input.constraints,CONSTRAINTS,'constraints'); if(e) return e; } if(input.mode!==undefined && !['persona','external_agent'].includes(input.mode)) return 'mode must be persona|external_agent'; if(input.external_votes!==undefined && !Array.isArray(input.external_votes)) return 'external_votes must be array'; return null; } ``` ```js function makeVotes(personaSet, action, constraints={}){ const txt = `${action.action_type||''}\n${action.summary||''}`; const flags = detectHardBlockFlags(txt); const highRisk = action.risk_level === 'high'; const irreversible = !!action.irreversible; const blockExfil = constraints.block_sensitive_exfiltration && flags.includes('SENSITIVE_DA ...[truncated 2204 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package.json:10
Finding: Dependency Version Ranges Contradict the Documented Reproducible-Install Trust Model
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

Category: Supply Chain
Confidence: 81% confidence
Finding: The lockfile pulls in fast-uri 3.1.0 via ajv, and the cited advisories indicate URI parsing and normalization flaws that can cause host confusion and potentially SSRF or policy bypass when attacker-controlled URLs are validated or canonicalized. Given this skill performs pre-execution governance for high-risk agent actions, any incorrect interpretation of URLs, hosts, or authorities in policy evaluation could directly weaken safety decisions, making this more dangerous in context than in a generic utility package.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The dependency version uses a caret range (^1.1.15), which allows future non-major releases to be installed. This can introduce supply-chain risk because builds are not fully reproducible and a compromised or buggy upstream minor/patch release could be pulled in without explicit review.
Content: Scanner excerpt · package.json (reported line 10)May include surrounding context.
json
"demo": "node --import tsx run.js --input ./examples/input.json" }, "dependencies": { "consensus-guard-core": "^1.1.15", "tsx": "^4.20.3" }, "license": "MIT",

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The tsx dependency is also specified with a caret range, allowing automatic adoption of later compatible releases. Although common in JavaScript projects, this weakens build determinism and increases exposure to upstream supply-chain compromise or unexpected behavior changes.
Content: Scanner excerpt · package.json (reported line 11)May include surrounding context.
json
}, "dependencies": { "consensus-guard-core": "^1.1.15", "tsx": "^4.20.3" }, "license": "MIT", "engines": {

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The handler persists a decision artifact containing the action proposal, votes, aggregation data, and response via writeArtifact(), but this file provides no user-facing indication that these governance records will be stored. In a pre-execution governance skill, those artifacts may include sensitive operational context, so silent persistence creates a privacy and data-governance issue even if it is not directly exploitable as code execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.