consensus-permission-escalation-guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:16 AM UTC
• Version: 0.1.13

Overview

The skill is disclosed as a local IAM-escalation decision gate, but it allows caller-supplied policy settings and external votes to influence high-impact approval decisions without enough trusted scoping.

Treat this as Review, not proven malware. Before installing it in any workflow that can actually grant permissions, ensure policy constraints are supplied from trusted deployment configuration, not from the requester; accept external_agent votes only after authentication/signature and duplicate/freshness checks; include vote evidence in replay/idempotency decisions; pin and audit dependencies; and run it with a dedicated non-privileged state directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.mjs:151

Finding

Request-Controlled Constraints Can Disable Security Safeguards

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.mjs:63

Finding

External Votes and Reputation Values Are Accepted Without Authentication

Content

View full analysis

0.95) return 'external_votes[].reputation_before must be 0.05..0.95'; if (!['YES', 'NO', 'REWRITE'].includes(v.vote)) return 'external_votes[].vote must be YES|NO|REWRITE'; if (typeof v.confidence !== 'number' || v.confidence < 0 || v.confidence > 1) return 'external_votes[].confidence must be 0..1'; if (!Array.isArray(v.reasons) || !Array.isArray(v.red_flags) || !Array.isArray(v.suggested_edits)) return 'external_votes[].reasons/red_flags/suggested_edits must be arrays'; return null; } ``` The validated caller-controlled votes are then used directly for aggregation: ```js const votes = externalMode ? input.external_votes : makePersonaVotes(personaSet, policyFlags); const ag = aggregateVotes(votes, { method: 'WEIGHTED_APPROVAL_VOTE', approve_threshold: 0.7 }); let final_decision = DECISION_MAP(ag.final_decision); if (policyFlags.hard_flags.length) final_decision = 'BLOCK'; else if (policyFlags.rewrite_flags.length && final_decision === 'ALLOW') final_decision = 'REQUIRE_REWRITE'; ``` ### Technical Analysis External vote validation checks only field presence, data types, enumerated vote values, and numeric ranges. It does not verify that: - The stated persona exists in a trusted persona set - The vote was produced by that persona - The caller is authorized to submit external votes - `reputati ...[truncated 1927 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.mjs:220

Finding

External Votes Are Omitted from the Idempotency Key

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

fast-uri 3.1.0 is flagged for multiple URI parsing and canonicalization issues, including host confusion and SSRF-relevant edge cases. This skill is explicitly a governance/security control around IAM and permission escalation decisions, so incorrect URI parsing in any downstream network, policy, callback, or artifact-handling logic could undermine trust boundaries or route requests to attacker-controlled targets.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The package uses a caret range for the ajv dependency, which allows automatic installation of newer minor and patch releases. While common in the Node.js ecosystem, this weakens build determinism and can introduce supply-chain risk if an upstream release is compromised or contains a breaking security regression.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"demo": "node --import tsx run.js --input ./examples/input.json"
  },
  "dependencies": {
    "ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The ajv-formats dependency is specified with a caret range, so future compatible releases may be pulled in without explicit review. In a security-governance skill, this increases supply-chain exposure because validation behavior is part of the trust boundary and unexpected upstream changes could affect policy enforcement.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json

},
  "dependencies": {
    "ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The consensus-guard-core dependency is unpinned, allowing newer minor or patch versions to be installed automatically. Because this package appears central to permission-escalation governance decisions, upstream changes or a compromised release could directly alter ALLOW/BLOCK logic, making the context more sensitive than a typical utility package.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"dependencies": {
    "ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"
  },
  "license": "MIT",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

The tsx dependency is also specified with a caret range, permitting unreviewed updates within the allowed semver range. Although likely used for testing and demo execution, compromised or unexpected dependency updates can still affect local execution paths and developer environments.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"ajv": "^8.17.1",
    "ajv-formats": "^3.0.1",
    "consensus-guard-core": "^1.1.15",
    "tsx": "^4.20.3"
  },
  "license": "MIT",
  "engines": {

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON manifest/test-vector file uses the mode value "external_agent" without any accompanying natural-language constraint about when that mode should or should not be used. In manifest-like files, broad activation descriptors without explicit scope can create ambiguity about invocation conditions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.