ShipGuard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 0.1.3

Overview

ShipGuard is a mostly coherent development workflow skill, but it automatically writes and reloads persistent project rules and can auto-execute some changes based on the agent's own classification.

Install only if you want ShipGuard to maintain project-local workflow state and influence future AI sessions. Review .dev-workflow changes before committing, require approval before adding hard rules, and consider disabling or manually controlling auto-execute and auto-loaded memory files for production or shared repositories.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:316

Finding

Automatic Promotion of Untrusted Lessons into Persistent Agent Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:316-339
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Vulnerable Code Snippet

markdown

## Gate 5 — Lessons (Auto, no confirmation needed)

Run automatically after CR closes. No user action required.

【经验沉淀 #CR-YYYYMMDD-NN】
任务类型：<type>

本次教训：
  - <what operation caused what problem>
  - <what to watch for next time with similar requests>

新增底层规则：
  ✅ 永远要做：<rule>
  ❌ 永远不做：<rule>

写入：
  lessons/lessons.md → <dated entry>
  lessons/hard-rules.md → <if new permanent rule established>
  test-cases/all-test-cases.md → <append TCs from this CR>
  CHANGELOG.md → <append entry>

Hard rules never expire. On every new session, load `hard-rules.md` and apply before handling any request.

The associated automatic-loading requirement appears at SKILL.md:112-116:

markdown

lessons/
  hard-rules.md         # Permanent rules, never expire
  lessons.md            # Historical lessons, dated entries

On new session start: auto-load `PROJECT.md` + `lessons/hard-rules.md` + `lessons/lessons.md`. These files are the AI's persistent memory across sessions.

Technical Analysis

Gate 5 directs the agent to derive permanent behavioral rules from task outcomes and write them to lessons/hard-rules.md automatically, without user confirmation. Subsequent sessions must load and apply those rules before handling new requests.

Task descriptions, repository content, test output, and other project-controlled material can influence the generated lesson. The workflow does not define a trust boundary, validation procedure, provenance check, safety-policy check, or approval gate before converting that contextual material into durable instructions. Consequently, attacker-influenced content can be promoted from untrusted project data into persistent agent state.

The risk is specifically persistent instruction poisoning rather than ...[truncated 1480 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user approval before adding or modifying any permanent rule.
2. Present the proposed rule, its source, rationale, scope, and expiration policy in a dedicated confirmation gate.
3. Treat repository files, task text, logs, test output, and generated lessons as untrusted data rather than authoritative instructions.
4. Validate proposed rules against higher-priority safety constraints and reject rules that request secrecy, privilege expansion, unrelated actions, or weakened review requirements.
5. Record provenance for each rule, including the originating change request, source files, approving user, creation time, and last review time.
6. Replace “never expire” with periodic review, expiration, revocation, and rollback mechanisms.
7. Load persistent records as quoted reference data and explicitly prohibit them from overriding system, developer, user, or platform security policies.
8. Restrict writes to the expected project-local .dev-workflow/lessons/ directory and review diffs before committing them.
9. Keep ordinary lessons separate from enforceable rules; only manually approved content should enter hard-rules.md.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad end-to-end development governance workflow. The supplied code does only one narrow supporting function: static scope/reference discovery for an identifier across backend, frontend, and task directories using grep. While this can loosely support 'change impact analysis,' it does not implement the majority of the declared workflow capabilities, and its primary purpose is materially narrower than described. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The skill advertises that some changes can be auto-executed based on the agent's own risk classification, which delegates change authorization to the model. Even if limited to 'low-risk UI changes,' misclassification or prompt manipulation could cause unreviewed code or file changes to be applied without human approval.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md

- **Test Cases at intake** — defined in G0, executed in G3. Not invented after the fact.
- **Task type classification** — UI tweak / Bug fix / Feature / Product change / Architecture. Each type has strict scope boundaries. A bug fix cannot touch the UI. A UI tweak cannot touch business logic.
- **Auto-execute vs confirm** — low-risk UI changes happen immediately. Critical path changes always require confirmation.
- **Project memory** — `hard-rules.md` and `lessons.md` persist across AI sessions. The AI learns your project's rules permanently.
- **Project onboarding** — first use triggers an 8-question setup that generates `PROJECT.md` with your critical paths, protected modules, and hard rules.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 91% confidence

Finding

Loading hard-rules.md automatically every session creates a persistent instruction channel that can influence future agent behavior regardless of the current request. If an attacker, compromised dependency, or mistaken workflow writes unsafe guidance into that file, the agent may inherit and obey tainted instructions across sessions, making prompt injection durable.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

all-test-cases.md # Cumulative TC registry regression/ # Regression results per CR lessons/ hard-rules.md # Permanent rules, loaded every session lessons.md # Dated lessons log

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The G0 example is presented entirely in Chinese, including required labels and confirmation text, with no indication that language is selectable or that the skill is intended only for Chinese-speaking contexts. This can violate language/locale policy because it implies a fixed output language without user opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to run shell commands such as grep and python scripts, but it declares no explicit tool scope or permissions boundary. That creates an authorization ambiguity where a host system may allow broader command execution than users expect, increasing the risk of unintended filesystem access or command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The activation criteria include common verbs like build, fix, refactor, add, change, and optimize, which can cause the skill to trigger on ordinary requests far outside the intended high-control workflow. Overbroad activation can unexpectedly steer user sessions, invoke shell-assisted discovery steps, and apply persistent workflow behavior where it was not requested.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The onboarding questionnaire is written entirely in Chinese and is presented as the required first-use interaction. Similar mandatory workflow cards later in the document are also defined in Chinese, with no opt-in or alternative language path. This creates a language policy issue because the skill appears to impose a specific language on users without choice.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 91% confidence

Finding

The skill defines persistent memory files such as hard-rules and lessons that are auto-loaded on every new session as authoritative context. Persistent context injection is risky because malicious or mistaken entries can silently shape future agent behavior, override user intent, and create long-lived prompt injection inside the repository.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

regression/ CR-YYYYMMDD-NN-regression.md lessons/ hard-rules.md # Permanent rules, never expire lessons.md # Historical lessons, dated entries

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 82% confidence

Finding

Gate 5 explicitly authorizes autonomous writes to persistent project memory and changelog artifacts without user confirmation. Unreviewed persistence can embed incorrect, manipulative, or overbroad rules into future sessions, influencing later decisions and potentially causing unauthorized behavior drift across the project lifecycle.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md

---

## Gate 5 — Lessons (Auto, no confirmation needed)

Run automatically after CR closes. No user action required.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 90% confidence

Finding

This section instructs the agent to append new lessons, hard rules, and cumulative test cases into persistent files, creating a self-modifying instruction base. Without review and trust boundaries, the skill can recursively strengthen incorrect or adversarial guidance and contaminate future sessions with hidden policy changes.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

写入： lessons/lessons.md → lessons/hard-rules.md → test-cases/all-test-cases.md → CHANGELOG.md →

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The templates are written entirely in Chinese and prescribe Chinese field labels and status text throughout, which constitutes a language/locale requirement in natural-language instructions. There is no indication that users may choose another language, nor any documented region-specific justification for the constraint.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 84% confidence

Finding

The file declares persistent rules that are automatically loaded at session start and applied before any request, which creates a durable prompt-injection surface. Even though the current listed rules appear process-oriented and benign, the mechanism allows future instructions placed here to silently steer model behavior across all sessions and potentially override user intent or security controls.

Content

Scanner excerpt · references/hard-rules.md (reported line 3)May include surrounding context.

md

# ShipGuard — Hard Rules

This file contains permanent rules that never expire.
Loaded automatically at session start. Applied before handling any request.

Format: [Date established] [CR that established it] Rule

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scope_check.py (reported line 15)May include surrounding context.

python

cmd = ["grep", "-rn", pattern, path, f"--include={include}"]
    if extra_flags:
        cmd.extend(extra_flags)
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.stdout.strip()

def section(title):

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README states that the skill will create and maintain files inside the target repository and persist memory across sessions, but it does not clearly warn users that repository contents will be modified automatically. In an AI-agent context, implicit file creation and mutation can surprise operators, alter tracked files, or introduce policy and privacy issues if the user did not explicitly approve persistent state.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

## Universal Rules (apply to all projects)

- [2026-05-24] [core] Never write code before requirement is confirmed by user
- [2026-05-24] [core] Never silently expand scope beyond G1 estimate
- [2026-05-24] [core] Never mix two task types in one CR — split them
- [2026-05-24] [core] Never close a CR without regression testing
- [2026-05-24] [core] Never self-downgrade a critical path change to "low risk"

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 425)May include surrounding context.

md

## Universal Rules (apply to all projects)

- [2026-05-24] [core] Never write code before requirement is confirmed by user
- [2026-05-24] [core] Never silently expand scope beyond G1 estimate
- [2026-05-24] [core] Never mix two task types in one CR — split them
- [2026-05-24] [core] Never close a CR without regression testing
- [2026-05-24] [core] Never self-downgrade a critical path change to "low risk"

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/hard-rules.md (reported line 13)May include surrounding context.

md

## Universal Rules (apply to all projects)

- [2026-05-24] [core] Never write code before requirement is confirmed by user
- [2026-05-24] [core] Never silently expand scope beyond G1 estimate
- [2026-05-24] [core] Never mix two task types in one CR — split them
- [2026-05-24] [core] Never close a CR without regression testing
- [2026-05-24] [core] Never self-downgrade a critical path change to "low risk"

Static analysis

No suspicious patterns detected.