Agent Guardrails

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:08 PM UTC
• Version: 1.0.0

Overview

This guardrails skill is mostly purpose-aligned, but it installs persistent Git hooks and can expose secret values in logs, so it should be reviewed before use.

Install only in repositories where you are comfortable with local Git hooks enforcing commits. Review the hook files before enabling the feedback loop, back up any existing hooks, and avoid running the current secret scanner in shared CI or logged agent sessions until it redacts detected values.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check-secrets.sh:45

Finding

Secret Scanner Prints Detected Credentials in Plaintext

Content

View full analysis

/dev/null || true) if [ -n "$MATCH" ]; then echo " 🚨 POSSIBLE SECRET in $file:" echo "$MATCH" | head -3 | sed 's/^/ /' ERRORS=$((ERRORS + 1)) fi done <<< "$FILES" done ``` ### Technical Analysis The scanner stores the complete matching source lines in `MATCH` and prints up to three of them without redaction. The configured patterns match API tokens, passwords, bearer tokens, AWS access-key identifiers, GitHub tokens, Slack tokens, and JWT-like values. Consequently, the scanner can reproduce the actual credential in its output. Security scanners should report the affected file, line number, and secret type while suppressing or masking the sensitive value. Printing the complete line can move a secret from a relatively restricted source file into less protected locations such as CI logs, terminal recordings, agent transcripts, build artifacts, or centralized logging systems. This behavior does not require command injection or control of the scanner itself. It is triggered by the presence of a credential matching one of the scanner's regular expressions. ### Attack Path 1. A secret is accidentally committed, generated, or otherwise placed in a scannable project file. 2. A developer, AI agent, pre-commit hook, or CI job executes `check-secrets.sh`. 3. `grep -Pn` returns the complete matching line, including the secret. 4. The script prints that line to standard output. 5. CI logging, terminal recording, or an agent execution environment retains the output. 6. A user with access to those logs can recover and use the expose ...[truncated 781 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/install-skill-feedback-loop.sh:193

Finding

Feedback-Loop Installer Unconditionally Replaces Existing Post-Commit Hook

Content

View full analysis

"$PROJECT_DIR/.git/hooks/post-commit" << 'HOOK_EOF' #!/bin/bash cd "$(git rev-parse --show-toplevel)" bash scripts/detect-enforcement-improvement.sh HOOK_EOF chmod +x "$PROJECT_DIR/.git/hooks/post-commit" echo "✅ Installed git post-commit hook" ``` ### Technical Analysis The installer writes directly to `.git/hooks/post-commit` with shell redirection. If that file already exists, it is silently truncated and replaced. Unlike the primary installer's pre-commit handling, this code does not detect or back up an existing hook, request confirmation, or chain the existing implementation. Git hooks are local tools that can implement security checks, compliance logging, repository synchronization, notifications, or other organization-specific controls. Replacing one changes the behavior of a legitimate Git operation: every subsequent commit executes the newly installed detection script while the previous hook no longer executes. The installed hook is persistent within the repository and runs after every commit. Installing such a hook is consistent with the Skill's declared feedback-loop functionality, but silently replacing unrelated existing tooling is not required to provide that functionality and violates least-surprise and safe tool-composition principles. ### Attack Path 1. A target repository already contains a `.git/hooks/post-commit` hook used for security, audit, synchronization, or another workflow. 2. A user runs `scripts/install-skill-feedback-loop.sh` as recommended by the Skill. 3. Shell redirection truncates the existing hook and writes the Skill's hook in its place. 4. The installer makes the replacement executable. 5. Fu ...[truncated 814 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The installation guide explicitly tells users how to bypass the pre-commit guardrails with git commit --no-verify, which disables the very secret detection and policy enforcement the skill claims to provide. In a security-focused skill, documenting an easy skip path materially weakens enforcement because an agent or user can avoid all checks before committing sensitive code or credentials.

Content

Scanner excerpt · CLAUDE_CODE_INSTALL.md (reported line 96)May include surrounding context.

Want to skip once?

bash

git commit --no-verify -m "message"

Need to update patterns?

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented 'skill update feedback loop' introduces automation that watches commits, writes tracking files, and can commit changes to skill definitions with optional reduced confirmation. In a security-oriented skill, self-propagating repository modification increases supply-chain and integrity risk, especially if heuristics misclassify changes or automate commits into shared skill content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented 'skill update feedback loop' introduces automation that watches commits, writes tracking files, and can commit changes to skill definitions with optional reduced confirmation. In a security-oriented skill, self-propagating repository modification increases supply-chain and integrity risk, especially if heuristics misclassify changes or automate commits into shared skill content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented 'skill update feedback loop' introduces automation that watches commits, writes tracking files, and can commit changes to skill definitions with optional reduced confirmation. In a security-oriented skill, self-propagating repository modification increases supply-chain and integrity risk, especially if heuristics misclassify changes or automate commits into shared skill content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documented 'skill update feedback loop' introduces automation that watches commits, writes tracking files, and can commit changes to skill definitions with optional reduced confirmation. In a security-oriented skill, self-propagating repository modification increases supply-chain and integrity risk, especially if heuristics misclassify changes or automate commits into shared skill content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documented 'skill update feedback loop' introduces automation that watches commits, writes tracking files, and can commit changes to skill definitions with optional reduced confirmation. In a security-oriented skill, self-propagating repository modification increases supply-chain and integrity risk, especially if heuristics misclassify changes or automate commits into shared skill content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented 'skill update feedback loop' introduces automation that watches commits, writes tracking files, and can commit changes to skill definitions with optional reduced confirmation. In a security-oriented skill, self-propagating repository modification increases supply-chain and integrity risk, especially if heuristics misclassify changes or automate commits into shared skill content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented 'skill update feedback loop' introduces automation that watches commits, writes tracking files, and can commit changes to skill definitions with optional reduced confirmation. In a security-oriented skill, self-propagating repository modification increases supply-chain and integrity risk, especially if heuristics misclassify changes or automate commits into shared skill content.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented 'skill update feedback loop' introduces automation that watches commits, writes tracking files, and can commit changes to skill definitions with optional reduced confirmation. In a security-oriented skill, self-propagating repository modification increases supply-chain and integrity risk, especially if heuristics misclassify changes or automate commits into shared skill content.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/skill-update-feedback.md (reported line 13)May include surrounding context.

The Loop:

text

Project improvement → [Manual remember?] → Update skill → Other projects benefit
                              ↑
                         Often breaks here

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/skill-update-feedback.md (reported line 68)May include surrounding context.

The Loop:

text

Project improvement → [Manual remember?] → Update skill → Other projects benefit
                              ↑
                         Often breaks here

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/install-skill-feedback-loop.sh (reported line 110)May include surrounding context.

sh

**The Loop:**
```
Project improvement → [Manual remember?] → Update skill → Other projects benefit
                              ↑
                         Often breaks here
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-secrets.sh (reported line 19)May include surrounding context.

sh

if [ -f "$TARGET" ]; then
    FILES="$TARGET"
elif [ -d "$TARGET" ]; then
    FILES=$(find "$TARGET" -type f \( -name "*.py" -o -name "*.sh" -o -name "*.js" -o -name "*.ts" -o -name "*.yaml" -o -name "*.yml" -o -name "*.json" -o -name "*.env" -o -name "*.toml" -o -name "*.cfg" -o -name "*.ini" \) \
        -not -path "*/.git/*" -not -path "*/node_modules/*" -not -path "*/__pycache__/*" -not -path "*/venv/*" 2>/dev/null || true)
else
    echo "❌ Target not found: $TARGET"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-secrets.sh (reported line 138)May include surrounding context.

sh

ERRORS=$((ERRORS + 1))
else
    MISSING_PATTERNS=()
    for pattern in '.env' '.env.*' '*.key' '*.pem' '*.p12' '*.pfx' 'id_rsa' 'id_ed25519' 'credentials.json'; do
        if ! grep -q "$pattern" .gitignore 2>/dev/null; then
            MISSING_PATTERNS+=("$pattern")
        fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-secrets.sh (reported line 155)May include surrounding context.

sh

ERRORS=$((ERRORS + 1))
else
    MISSING_PATTERNS=()
    for pattern in '.env' '.env.*' '*.key' '*.pem' '*.p12' '*.pfx' 'id_rsa' 'id_ed25519' 'credentials.json'; do
        if ! grep -q "$pattern" .gitignore 2>/dev/null; then
            MISSING_PATTERNS+=("$pattern")
        fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-secrets.sh (reported line 138)May include surrounding context.

sh

ERRORS=$((ERRORS + 1))
else
    MISSING_PATTERNS=()
    for pattern in '.env' '.env.*' '*.key' '*.pem' '*.p12' '*.pfx' 'id_rsa' 'id_ed25519' 'credentials.json'; do
        if ! grep -q "$pattern" .gitignore 2>/dev/null; then
            MISSING_PATTERNS+=("$pattern")
        fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check-secrets.sh (reported line 155)May include surrounding context.

sh

ERRORS=$((ERRORS + 1))
else
    MISSING_PATTERNS=()
    for pattern in '.env' '.env.*' '*.key' '*.pem' '*.p12' '*.pfx' 'id_rsa' 'id_ed25519' 'credentials.json'; do
        if ! grep -q "$pattern" .gitignore 2>/dev/null; then
            MISSING_PATTERNS+=("$pattern")
        fi

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/install-skill-feedback-loop.sh (reported line 93)May include surrounding context.

sh

SKILL="agent-guardrails"
fi

echo "📝 Should update skill: $SKILL"

# Create task
TASK_FILE="$WORKSPACE/.pending-skill-updates.txt"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/install-skill-feedback-loop.sh (reported line 214)May include surrounding context.

sh

SKILL="agent-guardrails"
fi

echo "📝 Should update skill: $SKILL"

# Create task
TASK_FILE="$WORKSPACE/.pending-skill-updates.txt"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/install-skill-feedback-loop.sh (reported line 250)May include surrounding context.

sh

SKILL="agent-guardrails"
fi

echo "📝 Should update skill: $SKILL"

# Create task
TASK_FILE="$WORKSPACE/.pending-skill-updates.txt"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · PUBLISHING.md (reported line 172)May include surrounding context.

md

**Problem:** AI agents forget important steps, bypass standards, and lose knowledge between projects.

**Solution:** Git hooks and automated checks that make it impossible to commit without verification.

**4 Failure Modes Prevented:**
1. Reimplementation (bypass patterns)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/deployment-verification-guide.md (reported line 303)May include surrounding context.

md

**Problem:** AI agents forget important steps, bypass standards, and lose knowledge between projects.

**Solution:** Git hooks and automated checks that make it impossible to commit without verification.

**4 Failure Modes Prevented:**
1. Reimplementation (bypass patterns)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

For Claude Code:

bash

git clone https://github.com/jzOcb/agent-guardrails ~/.claude/skills/agent-guardrails
cd your-project && bash ~/.claude/skills/agent-guardrails/scripts/install.sh .

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/SKILL_CN.md (reported line 63)May include surrounding context.

For Claude Code:

bash

git clone https://github.com/jzOcb/agent-guardrails ~/.claude/skills/agent-guardrails
cd your-project && bash ~/.claude/skills/agent-guardrails/scripts/install.sh .

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/check-secrets.sh:90