consensus-code-merge-guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:54 AM UTC
• Version: 1.1.15

Overview

The skill is broadly aligned with merge-governance use, but its implementation can approve and persist merge decisions without the existing persona governance the documentation says is required.

Review this skill carefully before using it to gate real merges. Its filesystem state writes and npm install path are disclosed and proportionate, but it should not be treated as an authoritative merge control until persona-set absence fails closed and external votes and constraints are strictly validated.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/index.mjs:23

Finding

Missing persona sets silently fall back to synthetic approving personas

Content

View full analysis

({persona_id:`default-${n}`,name:`Default Persona ${n}`,reputation:0.5})) }; } ``` ### Technical Analysis In persona mode, the implementation attempts to load either the requested persona set or the latest persona-set artifact. If no such artifact exists, it does not reject the request. Instead, it silently creates five synthetic personas with equal reputations. These generated personas are subsequently passed to `makeVotes()`. Unless optional, caller-controlled constraints detect failing tests or one of a small set of security-related phrases, each synthetic persona votes `YES`. This is a fail-open condition in a security and release-governance control. This behavior conflicts with the documented invocation contract in `SKILL.md`, which states that persona mode requires an existing `persona_set_id` and that the guard does not generate persona sets internally. The fallback can therefore produce an apparently governed `MERGE` decision despite the absence of the required governance state. ### Attack Path 1. An attacker or improperly configured caller invokes the guard in persona mode. 2. The caller omits `persona_set_id` when no latest persona set exists, or supplies an identifier that does not resolve to an existing persona set. 3. The caller omits `require_tests_pass` and `block_on_security_flags`, or supplies a change summary that does not match the narrow security-expression check. 4. The guard creates five synthetic personas rather than returning an error. 5. Each synthetic persona votes `YES`. 6. The votes are aggregated and can result in `MERGE`. 7. The decision is written to board state as an auditable decision artifact, making the bypass appear to be a legitimate governed outcome. ### Impact ...[truncated 529 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.mjs:6

Finding

External votes and security constraints are accepted without strict schema validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 82% confidence

Finding

The lockfile includes fast-uri 3.1.0, which is reported with multiple URI parsing and canonicalization issues including host confusion and potential SSRF-relevant edge cases. This is a true dependency risk if any component uses fast-uri for security-sensitive URL validation, allowlisting, or request routing, and the merge-governance skill context increases concern because automation tooling may process untrusted repository or network metadata.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The lockfile pins esbuild to 0.27.3, and the cited advisory affects esbuild's development server on Windows by allowing arbitrary file read in a specific runtime configuration. This is a real supply-chain risk, but in this skill's context it appears to be a build/runtime tool dependency rather than evidence of malicious code, so exploitability depends on whether the skill actually launches esbuild's dev server on Windows.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The dependency uses a caret range, which allows newer compatible versions to be installed over time. This can introduce supply-chain risk because a compromised or breaking upstream release could be pulled into future installs without explicit review, especially for a security-relevant merge-governance skill.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"demo": "node --import tsx run.js --input ./examples/input.json"
  },
  "dependencies": {
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"
  },
  "license": "MIT",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The tsx dependency is also specified with a caret range, allowing automatic drift to later versions. Although this is common in development tooling, it still creates a supply-chain exposure because the tool is executed directly via node --import tsx in test and demo workflows.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json

},
  "dependencies": {
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"
  },
  "license": "MIT",
  "engines": {

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The handler persists a decision via writeArtifact, which is a file or state write operation covered by the missing-warning rule for code files. In this file there is no confirmation prompt, logging, print, docstring, or comment disclosing that persistent board state will be written.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.