Kevros Governance

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:56 PM UTC
• Version: 0.3.8

Overview

This is a coherent integration guide for an external agent-governance service, with disclosed network calls and SDK installs, but users should minimize sensitive payloads and verify dependencies.

Install only if you are comfortable sending selected agent action metadata to the Kevros/TaskHawk governance service. Redact or schema-limit action_payload values, avoid secrets and personal data, review the provider's retention and logging terms, keep API keys out of source code and logs, and pin or verify SDK package versions before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:68
• Finding: Unpinned Third-Party SDK Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 68–69 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Code Snippet**: ```markdown - **Python SDK**: `pip install kevros` - **TypeScript SDK**: `npm install @kevros/agentkit` ``` ### Technical Analysis The installation instructions use mutable package names without version constraints, integrity hashes, or lockfiles. Consequently, package managers may resolve a different release each time the instructions are followed. The installed package contents and transitive dependencies are not present in the audited project and therefore could not be reviewed. In addition, the Python example imports `kevros_governance`, while the installation instruction identifies the distribution as `kevros`. This may be legitimate, but the project provides no publisher verification or source reference that establishes the relationship between these names. Package installation can execute dependency-controlled setup or lifecycle behavior. If the package, publisher account, registry namespace, or a transitive dependency is compromised, an attacker could distribute code that executes during installation or later when the SDK is imported. ### Attack Path 1. An attacker compromises the package publisher, registry namespace, release process, or an unpinned transitive dependency. 2. The attacker publishes a malicious release under the package name or dependency tree referenced by the Skill. 3. A user follows the documented `pip install kevros` or `npm install @kevros/agentkit` instruction. 4. The package manager resolves the attacker-controlled release because no reviewed version or integrity hash is specified. 5. Malicious setup, lifecycle, import-time, or runtime code executes in the user's environment. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the account performing the installation or running th ...[truncated 305 chars]
• Remediation: ## Remediation Suggestions - Pin each SDK to a specifically reviewed version rather than installing the latest available release. - Provide lockfiles and cryptographic integrity verification, such as Python hash-checked requirements and npm lockfile integrity metadata. - Document and verify the official registry publisher, package repository, signing process, and release provenance. - Clarify the relationship between the `kevros` Python distribution and the `kevros_governance` import namespace. - Pin and routinely audit transitive dependencies. - Prefer reproducible builds and signed release artifacts. - Recommend installation in an isolated, least-privileged environment without access to production secrets.

other

Warning

• Location: SKILL.md:13
• Finding: Agent Action Payloads May Disclose Sensitive Operational Data to an External Service## Vulnerability Details **File Location**: `SKILL.md`, lines 13–20 and 27–39 **Vulnerability Type**: `other: Sensitive Data Disclosure Risk` **Risk Level**: Medium **Code Snippet**: ```python from kevros_governance import GovernanceClient client = GovernanceClient(agent_id="my-agent") result = client.verify( action_type="trade", action_payload={"symbol": "AAPL", "qty": 100}, agent_id="my-agent", ) print(result.decision) # ALLOW, CLAMP, or DENY ``` ```bash # Get a free API key (instant, no credit card) curl -X POST https://governance.taskhawktech.com/signup \ -H "Content-Type: application/json" \ -d '{"agent_id": "my-agent"}' # Verify an action curl -X POST https://governance.taskhawktech.com/governance/verify \ -H "X-API-Key: kvrs_..." \ -H "Content-Type: application/json" \ -d '{"action_type": "deploy", "action_payload": {"service": "api"}, "agent_id": "my-agent"}' ``` ### Technical Analysis The documented workflow sends an agent identifier, action type, and action payload to `governance.taskhawktech.com`. The Skill describes governance for deployment, financial, and data-access operations, so production payloads could contain confidential infrastructure names, transaction details, customer or resource identifiers, internal commands, or other sensitive operational metadata. HTTPS is used in the examples, which protects data in transit against ordinary passive interception. However, the documentation does not instruct users to minimize or redact payloads, avoid secrets and personal data, obtain consent, or evaluate the external provider's retention and processing practices. It also does not present a local or self-hosted evaluation option. The risk therefore concerns disclosure across a third-party trust boundary, not plaintext transport. ### Attack Path 1. An agent prepares a deployment, trade, data-access, or similar sensitive action. 2. An integration places full op ...[truncated 944 chars]
• Remediation: ## Remediation Suggestions - Send only policy-relevant attributes instead of complete action payloads. - Use hashes, opaque references, or locally derived classifications where the service does not require raw values. - Explicitly prohibit submission of credentials, tokens, private keys, personal data, proprietary source code, and unnecessary command content. - Add payload-redaction and schema-allowlisting controls before network transmission. - Document the service's data retention, logging, deletion, residency, subprocessors, and incident-response policies. - Require users to review the third-party trust boundary and obtain any necessary organizational or data-subject consent. - Provide a local or self-hosted policy-evaluation option for sensitive environments. - Keep API keys outside source code and logs, rotate them regularly, and scope them to the minimum required permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to send agent identifiers and action payloads to a third-party governance service, but it does not clearly warn that operational data will leave the local environment. In an agent context, action payloads may contain sensitive business logic, deployment details, financial instructions, or regulated data, so silent external disclosure creates a real confidentiality and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Get a free API key (instant, no credit card)
curl -X POST https://governance.taskhawktech.com/signup \
  -H "Content-Type: application/json" \
  -d '{"agent_id": "my-agent"}'

• Confidence: 91% confidence
• Finding: The example uses curl to POST agent_id and verification data to an external domain, normalizing outbound transmission to a remote service. Even though this appears to be the product's intended behavior, the skill content does not communicate privacy, retention, or sensitivity implications, which is risky for agents that may forward confidential or security-relevant action metadata.

Static analysis

No suspicious patterns detected.