Shadows Deploy Guardian

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:39 AM UTC
• Version: 1.1.0

Overview

The skill is mostly a coherent pre-deployment checklist, but it runs project-controlled commands and unpinned npx tools that can execute unexpected code, and its secret scan can print credentials into logs.

Install only if you will run it on trusted repositories or inside a sandbox/CI runner with minimal credentials. Treat its terminal output as sensitive, because the secret check may print real credentials. Prefer changing npx calls to local pinned tools or no-install mode before relying on it for production deployment review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:91

Finding

Unpinned npx Commands May Download and Execute Untrusted Packages

Content

View full analysis

&1 # Python (if .py files exist) [ -f pyproject.toml ] && python -m ruff check . 2>&1 # ESLint (if .eslintrc* exists) ls .eslintrc* eslint.config.* 2>/dev/null && npx eslint . 2>&1 ``` ### Technical Analysis The skill invokes `npx tsc` and `npx eslint` without requiring locally installed, lockfile-pinned executables and without using a no-download option. When the requested executable is not available locally, `npx` may resolve and download a package from the configured package registry before executing it. The presence of `tsconfig.json`, `.eslintrc*`, or `eslint.config.*` is insufficient to establish that the expected package is safely installed. In particular, the executable name `tsc` does not itself guarantee that it resolves to the expected TypeScript compiler package. Because package resolution can depend on the local environment, registry configuration, and available dependencies, reviewed skill behavior can change at runtime. A compromised registry package, dependency-confusion condition, malicious registry configuration, or unintended package resolution could therefore introduce arbitrary code execution. ### Attack Path 1. An attacker prepares or influences a repository containing `tsconfig.json` or an ESLint configuration file. 2. The repository does not contain a trusted local installation of the corresponding executable, or its dependency state causes `npx` to perform remote resolution. 3. The user invokes the Deploy Guardian skill against that repository. 4. Gate 3 runs `npx tsc` or `npx eslint`. 5. `npx` resolves and potentially downloads a package from the configured registry. 6. The resolved package executes with the same operating-system permissions, network access, environment variab ...[truncated 629 chars]

Remediation

View remediation

&1 npx --no-install eslint . 2>&1 ``` 3. Prefer explicit local executable paths where supported: ```bash ./node_modules/.bin/tsc --noEmit ./node_modules/.bin/eslint . ``` 4. Verify that a supported lockfile exists and install dependencies using reproducible, lockfile-enforcing commands such as `npm ci`. 5. Skip or fail the applicable check if the trusted local executable is unavailable rather than resolving it dynamically. 6. Execute all repository-controlled tools inside a restricted sandbox with minimal credentials, limited filesystem access, and controlled network egress. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:125

Finding

Secret Scan Prints Suspected Credential Values to Logs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The secret-scan step enumerates tracked .env files and greps recent diffs for secret-like values, which can expose sensitive filenames and matched secret content in terminal output. In agent or logged environments, that can turn detection logic into a disclosure vector, especially because the skill itself notes output may reveal secret-like patterns.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

# Check for leaked secrets in recent commits (last 5)
git diff HEAD~5..HEAD -- . ':!*.lock' ':!*.sum' | grep -inE "(api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*['\"][^'\"]{8,}" || echo "PASS: No secrets pattern detected"

# Check .env files not committed to git
git ls-files | grep -E "\.env$|\.env\.\w+" | head -10

# Check .gitignore has secret patterns

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

Using npx tsc without pinning a version can cause execution of whatever package/version npx resolves in the current environment, including downloading code at runtime if the dependency is absent locally. In a security-sensitive agent skill, this weakens reproducibility and creates a supply-chain execution path.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

Using npx eslint without a pinned version has the same supply-chain and reproducibility risk: npx may execute a transient or unexpected package version when a local install is missing. Because this skill is meant to be run by an agent, that creates avoidable remote code execution exposure through dependency resolution.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill explicitly instructs running repository-controlled commands such as npm test, cargo test, and npm run build, which execute arbitrary code from the target repository. Even though the document warns about trusted repos and sandboxing, the capability remains dangerous in an agent context because a malicious repository can abuse test/build hooks for code execution, exfiltration, or system modification.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

## SECURITY CONSIDERATIONS

1. **Code execution**: Gates 2-4 execute project scripts (`npm test`, `npm run build`, `cargo test`). These commands run arbitrary code from the repository. **Only run this skill on repositories you trust**, or execute within a sandboxed environment (Docker container, CI/CD pipeline, OpenClaw sandbox mode).

2. **Secret exposure**: Gate 5 scans diffs for secret patterns. Matched patterns are displayed in terminal output. Ensure your terminal session is not logged to shared monitoring systems.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md

4. **SKIP is not FAIL** — absent toolchains produce SKIP, not FAIL
5. **Test failures block deployment** — even flaky tests must be investigated
6. **Document blockers** — always explain WHY with file:line references
7. **Never auto-deploy** — always wait for explicit user confirmation
8. **Trusted repos only** — warn user if running on an unfamiliar repository

---

Static analysis

No suspicious patterns detected.