Security audit

DriftWatch — Agent Identity Drift Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill does the advertised drift audit, but it can send sensitive workspace diffs to Claude by default and writes reports despite claiming it is read-only.

Review this carefully before installing. Use `--no-llm` for local-only scans, avoid cron mode unless you are comfortable sending identity and memory diff snippets to Claude, and treat the generated approval/confidence labels as advisory rather than proof of human review.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: driftwatch.py:33
Finding: Tracked Workspace Content Is Disclosed to an External LLM by Default
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: driftwatch.py:152
Finding: Untrusted Git Content Can Inject Instructions into the LLM Security Analysis
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: driftwatch.py:222
Finding: Commit-Message Prefixes Can Falsely Mark Unauthorized Changes as Human-Approved
Content: View full analysis
dict: """Simple heuristic analysis when LLM is unavailable.""" msg = change.get("message", "").lower() diff = change.get("diff", "").lower() # Commit message heuristics human_prefixes = ("feat:", "fix:", "chore:", "docs:", "refactor:", "hail-mary:", "team:", "agents:") human_approved = any(msg.startswith(p) for p in human_prefixes) # Drift heuristics concern_level = "none" concern_reason = "" danger_phrases = ["remove constraint", "no longer", "can now", "permission to", "autonomy", "without asking", "on my own"] for phrase in danger_phrases: if phrase in diff: concern_level = "medium" concern_reason = f"Diff contains '{phrase}' — may indicate autonomy expansion" break ``` ### Technical Analysis The heuristic treats a conventional commit-message prefix as evidence of human approval. Commit messages are supplied by the committer and do not authenticate identity, prove review, or demonstrate authorization. Any contributor or automated agent capable of creating a commit can prepend `fix:`, `chore:`, `docs:`, or another accepted value. The resulting change is then represented as human-approved regardless of who made it or whether an authorized reviewer accepted it. The issue is especially relevant when `--no-llm` is used or when LLM analysis fails and the implementation falls back to `_heuristic_analysis`. The same unsafe assumption is also explicitly included in the LLM guidelines. ### Attack Path 1. An agent or unauthorized contributor modifies `SOUL.md`, `AGENTS.md`, a memory index, or another tracked file. 2. The contributor creates a commit with an accepted prefix, such as `fix: update constraints`. 3. Dri ...[truncated 1033 chars]
Remediation: View remediation

other

Note

Location: SKILL.md:48
Finding: Read-Only Documentation Conflicts with Report File Creation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The manifest describes a read-only local audit tool, but the documented behavior indicates external LLM invocation, report-file writes, and monitoring of files beyond the declared set. This mismatch is dangerous because operators may approve or run the skill under false assumptions, leading to unintended data exfiltration of diffs/history and unexpected filesystem modification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Claiming the skill is read-only while also stating that it writes a markdown report to disk is a direct integrity and transparency violation. Even if the write is only a report, this can mislead users, bypass stricter review for mutating skills, and create opportunities for sensitive history-derived content to be persisted unexpectedly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is described as local git-history monitoring, but its default path submits diff snippets to an external Claude CLI for semantic analysis. That is a material capability expansion involving possible data exfiltration and third-party processing, which users are not clearly warned about.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill advertises itself as read-only and safe to run anytime, but it writes markdown reports and optional JSON files to disk. This mismatch can mislead operators and automated systems into granting the tool broader trust than warranted, especially in environments where write operations are restricted or monitored.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
LLM flags for: - Softening of constraints ("must" → "should", removing "ask first" rules) - Autonomy expansion language ("can now", "without asking", "on my own") - Removal of deferential/safety language - Changes with no corresponding commit message explaining why

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · driftwatch.py (reported line 237)May include surrounding context.
python
LLM flags for: - Softening of constraints ("must" → "should", removing "ask first" rules) - Autonomy expansion language ("can now", "without asking", "on my own") - Removal of deferential/safety language - Changes with no corresponding commit message explaining why

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises itself without any explicit tool-scope declaration even though its documented behavior implies shell execution and file access. In a skill ecosystem, missing permission boundaries increases the chance that an agent invokes the skill with broader capabilities than users expect, weakening reviewability and containment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Internal documentation contradictions about whether the skill modifies files create operator confusion and undermine safe deployment decisions. In security-sensitive agent tooling, ambiguity itself is risky because users may grant trust or automate execution based on the safer-sounding statement while the skill still performs writes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring frames the tool as a git-history tracker while omitting that semantic analysis is performed through Claude by default. This mischaracterization weakens informed consent and can cause users to run the tool under false assumptions about locality, privacy, and trust boundaries.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · driftwatch.py (reported line 59)May include surrounding context.
python
def git(cmd: list[str], cwd: Path = WORKSPACE) -> str: """Run a git command and return stdout.""" result = subprocess.run( ["git"] + cmd, cwd=cwd, capture_output=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: This call sends repository diff content to an external Claude CLI by default, which can disclose sensitive identity, memory, or policy file contents outside the local workspace. The danger is increased because the skill is presented as a read-only local audit tool, so users may not expect external transmission of tracked content.
Content: Scanner excerpt · driftwatch.py (reported line 192)May include surrounding context.
python
]""" try: result = subprocess.run( ["claude", "--print", "--model", "claude-haiku-4-5", prompt], capture_output=True, text=True,

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Invoking an external LLM subprocess introduces networked or third-party processing capability beyond a straightforward git audit, increasing the trust boundary and data exposure surface. In the context of identity and memory files, that can expose sensitive operational instructions or internal state not necessary for basic monitoring.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Tracked file diffs are forwarded to an external LLM CLI without an explicit warning or consent step, which creates a clear confidentiality risk. Since the files include identity and memory artifacts, the transmitted content may contain sensitive prompts, policies, or operational details that should remain local.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Allowing arbitrary paths via --files expands the tool beyond the declared identity-file scope and can be used to inspect unrelated workspace files. Because the default behavior may then forward diff snippets to an external LLM, this scope expansion can become an unintended data-exposure channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This markdown file documents that DriftWatch writes output to drift-report-YYYY-MM-DD.md, which is a file-system modification. The README does not explicitly warn users that running the tool will create or overwrite report files, so the behavior may affect user data or workspace state without clear disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The report output forces a specific timezone/locale marker in natural-language output regardless of user preference or system locale. This can violate language/locale policy when the skill imposes a locale-specific format without opt-in or justification.
Content: No source excerpt is available for this finding.