Security audit

autonomy-gate

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent autonomy-governance policy, but it lets the agent influence its own authorization state and includes broad emergency shutdown authority.

Review this skill carefully before installing. It should be limited to advisory checks unless you separately enforce operator-only approval for privilege increases, validate approved channels/templates, and remove or tightly scope autonomous service shutdown.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:105
Finding: Agent-Writable Authorization State Enables Privilege Escalation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:79
Finding: Operator Silence Authorizes Potentially Destructive Service Shutdown
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/state.json:2
Finding: Outbound Authorization Uses Placeholder Destinations and an Empty Template Allowlist
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad phrases like "자율성", "권한 체크", and "레벨 확인", which are common enough to activate during ordinary discussion rather than an explicit request to run this governance workflow. Because the skill governs external actions and authority checks, accidental invocation could steer agent behavior, cause unnecessary state evaluation, or prime later privileged actions under the wrong context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs updating references/state.json and creating review files in memory/ without requiring a user-visible warning or confirmation before modifying local data. Even though these are internal files, they affect future authorization decisions and audit history, so silent writes could alter effective agent permissions or create misleading governance records without operator awareness.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON state file contains multiple human-readable values in Korean, including history reasons and incident metadata/descriptions, with no indication that the skill is region-specific or that users can choose their preferred language. That creates a language/locale policy concern because the skill's natural-language content appears to impose a specific language by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.