consensus-deployment-guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:16 AM UTC
• Version: 0.1.10

Overview

The skill largely does what it claims, but it needs review because unbounded external vote data can be persisted and may exhaust storage or runtime resources in deployment automation.

Before installing in CI/CD automation, require bounded input sizes, maxItems/maxLength limits for external votes and nested strings, artifact-size checks, rate limits, and a dedicated non-privileged state directory. Also update or audit the dependency set. I found no evidence of intentional deception, exfiltration, credential theft, or destructive system behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: spec/input.schema.json:10

Finding

Unbounded External Vote Input Can Cause Resource Exhaustion

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

fast-uri 3.1.0 is directly present as a transitive dependency of ajv and is associated with multiple high-severity URI parsing issues including host confusion and potential SSRF bypasses. Because this skill is a deployment-governance component that likely validates and interprets structured request data, flawed URI canonicalization in dependency code could undermine security decisions if attacker-controlled URLs, hosts, or schema formats are processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"demo": "node --import tsx run.js --input ./examples/input.json"
  },
  "dependencies": {
    "ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json

},
  "dependencies": {
    "ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"dependencies": {
    "ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"
  },
  "license": "MIT",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"
  },
  "license": "MIT",
  "engines": {

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This .mjs code performs a state-changing write via writeArtifact, which can affect persisted board data. The file contains no confirmation prompt, user-facing log/print, or inline comment/docstring disclosing that the handler will write a decision record.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.