Enterprise Legal Guardrails Public

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:09 PM UTC
• Version: 1.0.20

Overview

This skill is a disclosed outbound guardrail tool, but its optional command-running wrapper has unsafe defaults and escape hatches that warrant careful review before installation.

Install only if you need both the policy checker and the command wrapper. For production use, prefer direct checker-only mode or require --strict, absolute-path allowlists, --sanitize-env with narrow keep rules, no --allow-any-command, and careful audit-log handling because command arguments and inherited credentials can be sensitive.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/guard_and_run.py:366

Finding

Human-review findings are permitted to execute by default

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/guard_and_run.py:107

Finding

Executable-name allowlist can be bypassed through PATH substitution

Content

View full analysis

bool: if not allowed: return True target = command[0] target_name = Path(target).name target_lower = target.lower() target_name_lower = target_name.lower() for pattern in allowed: if not pattern: continue pattern = pattern.strip() if not pattern: continue candidate = pattern.lower() if candidate.startswith("regex:"): expr = candidate.split(":", 1)[1] try: if re.fullmatch(expr, target_lower): return True except re.error as exc: raise RuntimeError(f"Invalid regex allowlist pattern '{pattern}': {exc}") from exc continue if fnmatch.fnmatch(target_lower, candidate) or fnmatch.fnmatch(target_name_lower, candidate): return True if Path(pattern).is_absolute(): try: if Path(target).resolve() == Path(pattern).resolve(): return True except OSError: if target_lower == pattern.lower(): return True elif target_lower == pattern.lower() or target_name_lower == pattern.lower(): return True return False ``` The validated command name is subsequently executed using environment-based path resolution: ```python env = None if args.sanitize_env: env = _sanitize_env(args.keep_env, args.keep_env_prefix) command_ms = None command_start = time.perf_counter() try: proc = subprocess.run(command, check=False, env=env, timeout=args.command_timeout) ``` ### Technical Analysis For a relative executable such as `python3` or `gog`, `_is_ ...[truncated 2133 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/guard_and_run.py:678

Finding

Rejected command arguments can be written to audit logs in plaintext

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description frames this as a legal/compliance guardrail, but the documented behavior includes a generic command-execution adapter, environment propagation controls, allowlist bypasses, and audit logging. This mismatch is dangerous because users may invoke or approve the skill assuming it only evaluates text, while it can act as an execution boundary that launches local commands, which materially increases attack surface and the risk of misuse or privilege abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata and docstring frame this as enterprise legal/compliance guardrails, but the implementation includes generic local command execution. That mismatch materially increases risk because operators may grant this skill trust and permissions appropriate for policy review, not for arbitrary process execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The --allow-any-command path explicitly bypasses the command allowlist and permits execution of any local command when a reason and token are provided, both of which can come from flags or environment variables. For a legal/compliance guardrail skill, this creates a direct arbitrary command execution escape hatch that undermines the control's stated purpose.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/tests_guard_and_run.py (reported line 16)May include surrounding context.

python

def run(*args: str, env: dict[str, str] | None = None, input_text: str | None = None) -> tuple[int, str, str]:
    if env is None:
        base_env = dict(os.environ)
        if not any(
            base_env.get(name)
            for name in (

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/guard_and_run.py (reported line 175)May include surrounding context.

python

assert "requires delimiter --" in err, (out, err)

# 6b) Missing allowlist by explicit env var should block execution.
env_no_allowlist = {k: v for k, v in os.environ.items() if k not in {
    "ENTERPRISE_LEGAL_GUARDRAILS_ALLOWED_COMMANDS",
    "ELG_ALLOWED_COMMANDS",
    "BABYLON_ALLOWED_COMMANDS",

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/tests_guard_and_run.py (reported line 142)May include surrounding context.

python

assert "requires delimiter --" in err, (out, err)

# 6b) Missing allowlist by explicit env var should block execution.
env_no_allowlist = {k: v for k, v in os.environ.items() if k not in {
    "ENTERPRISE_LEGAL_GUARDRAILS_ALLOWED_COMMANDS",
    "ELG_ALLOWED_COMMANDS",
    "BABYLON_ALLOWED_COMMANDS",

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/tests_guard_and_run.py (reported line 282)May include surrounding context.

python

"--",
    "cat",
    "/etc/hosts",
    env={**os.environ.copy(), "BABYLON_ALLOWED_COMMANDS": "python3"},
)
assert code == 1, (code, out, err)
assert "not in the allowlist" in err, (out, err)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/tests_guard_and_run.py (reported line 335)May include surrounding context.

python

"--",
    "cat",
    "/etc/hosts",
    env={**os.environ.copy(), "BABYLON_ALLOWED_COMMANDS": "python3"},
)
assert code == 1, (code, out, err)
assert "not in the allowlist" in err, (out, err)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The tested --allow-any-command escape hatch intentionally bypasses the command allowlist when a reason and token are supplied, defeating the primary execution safeguard. In a guardrails skill, this is especially risky because it creates a built-in path from constrained execution to arbitrary command execution if tokens are exposed, guessed, mishandled, or approved too broadly.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/tests_guard_and_run.py (reported line 507)May include surrounding context.

python

"python3",
        "-c",
        "import os; print('KEEP_ME' in os.environ, any(k.startswith('SHARED_') for k in os.environ), 'DROP_ME' in os.environ)",
        env={
            **os.environ,
            "KEEP_ME": "1",
            "SHARED_TOKEN": "2",

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/tests_guard_and_run.py (reported line 553)May include surrounding context.

python

# 16) Execution requires explicit enablement unless --dry-run is used.
with tempfile.TemporaryDirectory() as tmpdir:
    log_path = Path(tmpdir) / "execute_disabled.jsonl"
    env_execute_off = {
        **os.environ,
        "ENTERPRISE_LEGAL_GUARDRAILS_EXECUTE": "0",
    }

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill exposes shell, file read/write, and environment-dependent behavior but does not declare an explicit tool scope or permissions boundary in the skill manifest. That creates a trust gap: downstream users and orchestrators may treat it as a passive policy checker, while the documented wrapper can execute commands and handle environment variables, increasing the chance of over-privileged or unintended use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest says the skill provides legal/compliance guardrails for anti-spam, defamation, privacy, and financial claims, but the code additionally scans for harassment and targeted abuse. While related to moderation, this is a distinct policy domain not represented in the stated purpose, creating a description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes guardrails for anti-spam, defamation, privacy, and financial claims, but the code also enforces a separate HR-sensitive workplace language policy. This expands the skill from the declared outbound legal/compliance domains into employee-relations content moderation, which is not disclosed in the manifest description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation minimizes the capability as a guardrail adapter for outbound/public-facing workflows, while the code can launch broad local commands unrelated to outbound actions. This deceptive or incomplete framing increases the chance of unsafe deployment, overtrust, and accidental exposure of powerful execution capability.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/guard_and_run.py (reported line 330)May include surrounding context.

python

start = time.perf_counter()
    try:
        proc = subprocess.run(
            args,
            text=True,
            capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

This subprocess invocation executes a user-supplied command after only allowlist checks, turning a legal/compliance guardrail skill into a general local command runner. In this skill context, that is dangerous because any misconfiguration, overbroad allowlist, or enabled bypass can lead to arbitrary local code execution under the agent's privileges.

Content

Scanner excerpt · scripts/guard_and_run.py (reported line 835)May include surrounding context.

python

command_ms = None
    command_start = time.perf_counter()
    try:
        proc = subprocess.run(command, check=False, env=env, timeout=args.command_timeout)
        command_ms = int((time.perf_counter() - command_start) * 1000)
    except FileNotFoundError:
        msg = f"Command not found: {command[0]}"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The test suite validates and normalizes behavior for a command-executing adapter far beyond the stated legal/compliance purpose, including command execution, environment passing, allowlist logic, and bypass cases. That widens the operational scope of the skill into a generic execution wrapper, increasing the chance it is reused as an execution primitive in contexts where only content guardrails were expected.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tests_guard_and_run.py (reported line 33)May include surrounding context.

python

base_env["ENTERPRISE_LEGAL_GUARDRAILS_EXECUTE"] = "1"

    command = [sys.executable, str(SCRIPT), *args]
    proc = subprocess.run(
        command,
        env=base_env,
        input=input_text,

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/guard_and_run.py (reported line 658)May include surrounding context.

python

env=env_no_allowlist,
)
assert code == 2, (code, out, err)
assert "Refusing --allow-any-command without approval token" in err, (out, err)

# 12d) Unsafe escape hatch: allow any command only when explicitly enabled + reason+token.
code, out, err = run(

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/tests_guard_and_run.py (reported line 377)May include surrounding context.

python

env=env_no_allowlist,
)
assert code == 2, (code, out, err)
assert "Refusing --allow-any-command without approval token" in err, (out, err)

# 12d) Unsafe escape hatch: allow any command only when explicitly enabled + reason+token.
code, out, err = run(

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The top-level docstring presents the tool as a deterministic local scan with no outside dependencies, but the implementation is also parameterized by multiple environment variables, including Babylon-specific app/scope settings. This is not a direct security problem, but the documentation overstates self-containment and omits behavior that materially affects when guardrails apply.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.