Shadows Deploy Guardian

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:39 AM UTC
• Version: 1.1.0

Overview

The skill is mostly a coherent pre-deployment checklist, but it runs project-controlled commands and unpinned npx tools that can execute unexpected code, and its secret scan can print credentials into logs.

Install only if you will run it on trusted repositories or inside a sandbox/CI runner with minimal credentials. Treat its terminal output as sensitive, because the secret check may print real credentials. Prefer changing npx calls to local pinned tools or no-install mode before relying on it for production deployment review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:91
• Finding: Unpinned npx Commands May Download and Execute Untrusted Packages<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:91-97` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```bash # TypeScript (if tsconfig.json exists) [ -f tsconfig.json ] && npx tsc --noEmit 2>&1 # Python (if .py files exist) [ -f pyproject.toml ] && python -m ruff check . 2>&1 # ESLint (if .eslintrc* exists) ls .eslintrc* eslint.config.* 2>/dev/null && npx eslint . 2>&1 ``` ### Technical Analysis The skill invokes `npx tsc` and `npx eslint` without requiring locally installed, lockfile-pinned executables and without using a no-download option. When the requested executable is not available locally, `npx` may resolve and download a package from the configured package registry before executing it. The presence of `tsconfig.json`, `.eslintrc*`, or `eslint.config.*` is insufficient to establish that the expected package is safely installed. In particular, the executable name `tsc` does not itself guarantee that it resolves to the expected TypeScript compiler package. Because package resolution can depend on the local environment, registry configuration, and available dependencies, reviewed skill behavior can change at runtime. A compromised registry package, dependency-confusion condition, malicious registry configuration, or unintended package resolution could therefore introduce arbitrary code execution. ### Attack Path 1. An attacker prepares or influences a repository containing `tsconfig.json` or an ESLint configuration file. 2. The repository does not contain a trusted local installation of the corresponding executable, or its dependency state causes `npx` to perform remote resolution. 3. The user invokes the Deploy Guardian skill against that repository. 4. Gate 3 runs `npx tsc` or `npx eslint`. 5. `npx` resolves and potentially downloads a package from the configured registry. 6. The resolved package executes with the same operating-system permissions, network access, environment variab ...[truncated 629 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require the relevant tools to be installed as lockfile-pinned project dependencies. 2. Prevent `npx` from downloading missing packages: ```bash npx --no-install tsc --noEmit 2>&1 npx --no-install eslint . 2>&1 ``` 3. Prefer explicit local executable paths where supported: ```bash ./node_modules/.bin/tsc --noEmit ./node_modules/.bin/eslint . ``` 4. Verify that a supported lockfile exists and install dependencies using reproducible, lockfile-enforcing commands such as `npm ci`. 5. Skip or fail the applicable check if the trusted local executable is unavailable rather than resolving it dynamically. 6. Execute all repository-controlled tools inside a restricted sandbox with minimal credentials, limited filesystem access, and controlled network egress. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:125
• Finding: Secret Scan Prints Suspected Credential Values to Logs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:125` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```bash git diff HEAD~5..HEAD -- . ':!*.lock' ':!*.sum' | grep -inE "(api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*['\"][^'\"]{8,}" || echo "PASS: No secrets pattern detected" ``` ### Technical Analysis The secrets scan pipes recent Git diff content into `grep`. By default, `grep` prints each entire matching line. Consequently, if a recent commit contains an API key, password, token, private key value, or similar credential, the command reproduces that sensitive line in terminal output. The skill acknowledges that matches may be displayed, but a warning does not prevent exposure. Audit output is commonly captured by agent transcripts, terminal logging, CI/CD job logs, monitoring systems, or shared report storage. This can propagate a credential from Git history into additional systems with different access and retention controls. ### Attack Path 1. A real credential or credential-like value is introduced into one of the five most recent commits. 2. A user or automated pipeline invokes the Deploy Guardian skill. 3. Gate 5 generates the recent Git diff and searches it with the configured regular expression. 4. `grep` finds the sensitive assignment and prints the complete matching line. 5. The terminal, AI-agent transcript, CI system, or monitoring platform captures the output. 6. A person or service with access to those logs can retrieve and potentially misuse the exposed credential. ### Impact Assessment The issue can disclose credentials present in recent Git history to every system and principal that can read the audit output. The resulting privileges depend on the exposed secret and may include access to external APIs, databases, cloud resources, deployment infrastructure, or private services. This command does not itself elevate operating-system privileges. Howev ...[truncated 217 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never print complete lines containing suspected secrets. 2. Report only the affected file name, line number, rule identifier, and a redacted fingerprint. 3. Use a dedicated secret scanner that supports redaction, such as Gitleaks, TruffleHog, or detect-secrets, and explicitly enable its redacted-output mode. 4. If retaining a custom scanner, process matches through a redaction step before emitting output. Preserve only a small prefix or irreversible hash when necessary for correlation. 5. Mark all secret-scan output as sensitive and prevent it from being written to public or broadly accessible logs. 6. Immediately revoke and rotate any genuine credential discovered in Git history; removing it from the latest revision alone is insufficient. 7. Consider scanning the full relevant Git history rather than only five commits, while maintaining strict output redaction. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

# Check for leaked secrets in recent commits (last 5)
git diff HEAD~5..HEAD -- . ':!*.lock' ':!*.sum' | grep -inE "(api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*['\"][^'\"]{8,}" || echo "PASS: No secrets pattern detected"

# Check .env files not committed to git
git ls-files | grep -E "\.env$|\.env\.\w+" | head -10

# Check .gitignore has secret patterns

• Confidence: 78% confidence
• Finding: The secret-scan step enumerates tracked `.env` files and greps recent diffs for secret-like values, which can expose sensitive filenames and matched secret content in terminal output. In agent or logged environments, that can turn detection logic into a disclosure vector, especially because the skill itself notes output may reveal secret-like patterns.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: Using `npx tsc` without pinning a version can cause execution of whatever package/version `npx` resolves in the current environment, including downloading code at runtime if the dependency is absent locally. In a security-sensitive agent skill, this weakens reproducibility and creates a supply-chain execution path.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: Using `npx eslint` without a pinned version has the same supply-chain and reproducibility risk: `npx` may execute a transient or unexpected package version when a local install is missing. Because this skill is meant to be run by an agent, that creates avoidable remote code execution exposure through dependency resolution.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## SECURITY CONSIDERATIONS

1. **Code execution**: Gates 2-4 execute project scripts (`npm test`, `npm run build`, `cargo test`). These commands run arbitrary code from the repository. **Only run this skill on repositories you trust**, or execute within a sandboxed environment (Docker container, CI/CD pipeline, OpenClaw sandbox mode).

2. **Secret exposure**: Gate 5 scans diffs for secret patterns. Matched patterns are displayed in terminal output. Ensure your terminal session is not logged to shared monitoring systems.

• Confidence: 90% confidence
• Finding: The skill explicitly instructs running repository-controlled commands such as `npm test`, `cargo test`, and `npm run build`, which execute arbitrary code from the target repository. Even though the document warns about trusted repos and sandboxing, the capability remains dangerous in an agent context because a malicious repository can abuse test/build hooks for code execution, exfiltration, or system modification.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

4. **SKIP is not FAIL** — absent toolchains produce SKIP, not FAIL
5. **Test failures block deployment** — even flaky tests must be investigated
6. **Document blockers** — always explain WHY with file:line references
7. **Never auto-deploy** — always wait for explicit user confirmation
8. **Trusted repos only** — warn user if running on an unfamiliar repository

---

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.