Wip Ai Devops Toolbox Private

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:56 PM UTC
• Version: 1.9.72

Overview

This DevOps toolbox is mostly disclosed, but it needs Review because it installs persistent agent hooks/MCP tools and contains confirmed unsafe shell-command paths plus bundled browser-cookie tooling outside the main purpose.

Install only if you are comfortable granting this package persistent control over developer tooling: global CLIs, Claude/OpenClaw hooks, user-scope MCP servers, repo/release mutation, and publishing credentials. Avoid using it on untrusted repositories until the installer and license scanner replace shell-string execSync calls with argument-vector execution, and do not load or use the bundled gstack browser cookie-import features unless you explicitly want local browser session cookies read into automation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: ai/repos/gstack-private/SKILL.md:203
• Finding: Unverified Remote Installer Is Piped Directly to Bash<![CDATA[ ## Vulnerability Details **File Location**: `ai/repos/gstack-private/SKILL.md:203-213` **Additional Locations**: `ai/repos/gstack-private/browse/SKILL.md:178`, `ai/repos/gstack-private/design-consultation/SKILL.md:219`, `ai/repos/gstack-private/design-review/SKILL.md:221`, `ai/repos/gstack-private/qa/SKILL.md:242`, `ai/repos/gstack-private/qa-only/SKILL.md:192`, `ai/repos/gstack-private/setup-browser-cookies/SKILL.md:185`, and generator `ai/repos/gstack-private/scripts/gen-skill-docs.ts:260` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```markdown If `NEEDS_SETUP`: 1. Tell the user: "gstack browse needs a one-time build (~10 seconds). OK to proceed?" Then STOP and wait. 2. Run: `cd <SKILL_DIR> && ./setup` 3. If `bun` is not installed: `curl -fsSL https://bun.sh/install | bash` ``` The same command is repeated in several generated or bundled gstack Skills: ```bash curl -fsSL https://bun.sh/install | bash ``` ### Technical Analysis The instruction downloads mutable content from an external domain and sends it directly to a command interpreter. The downloaded script is neither pinned to a version nor checked against a cryptographic hash or signature. It is also not saved locally for inspection before execution. Although `bun.sh` is associated with the Bun runtime required by the nested gstack tooling, executing a mutable network response means the effective code is not the same fixed code that was reviewed in this repository. Compromise of the remote service, its deployment pipeline, DNS resolution, or the TLS trust chain could change the executed payload without modifying this project. The command appears in active Skill instructions and in the source generator, so regenerating the documentation will preserve the unsafe behavior. ### Attack Path 1. An agent loads one of the bundled gstack Skills. 2. The setup check determines that the compiled browser command or Bun runtime is una ...[truncated 913 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every pipe-to-shell installation instruction, including the template in `scripts/gen-skill-docs.ts`. 2. Require an explicitly selected and pinned Bun version. 3. Download the versioned release artifact to a local file without executing it. 4. Verify its SHA-256 digest or vendor-provided cryptographic signature against a value obtained through an independent trusted channel. 5. Display the source, version, destination, and expected filesystem changes before execution. 6. Execute the verified local installer only after separate user approval. 7. Prefer a trusted operating-system package manager where available. 8. Add a repository test that rejects patterns such as `curl ... | bash`, `wget ... | sh`, and equivalent shell substitutions in generated Skills. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: tools/wip-universal-installer/install.js:765
• Finding: Command Injection Through Installer Target and Flag Arguments<![CDATA[ ## Vulnerability Details **File Location**: `tools/wip-universal-installer/install.js:765-771` and `tools/wip-universal-installer/install.js:791-797` **Vulnerability Type**: OS command injection **Risk Level**: Critical ### Vulnerable Code ```js const flags = args.filter(a => a.startsWith('--')); const rawTarget = process.argv[2]; execSync(`ldm install ${rawTarget} ${flags.join(' ')}`, { stdio: 'inherit' }); ``` The same unsafe delegation is repeated after automatic LDM bootstrap: ```js const flags = args.filter(a => a.startsWith('--')); const rawTarget = process.argv[2]; try { execSync(`ldm install ${rawTarget} ${flags.join(' ')}`, { stdio: 'inherit' }); process.exit(0); } catch (delegateErr) { if (!JSON_OUTPUT) console.error(' ldm install failed. Falling back to standalone installer.'); } ``` The values originate from raw process arguments: ```js const args = process.argv.slice(2); const DRY_RUN = args.includes('--dry-run'); const JSON_OUTPUT = args.includes('--json'); const target = args.find(a => !a.startsWith('--')); ``` ### Technical Analysis `execSync()` executes a command string through a shell. Both `rawTarget` and every argument beginning with `--` are concatenated into that string without shell escaping, validation, or an allowlist. Consequently, shell metacharacters, substitutions, redirections, and command separators in an attacker-influenced target or flag can be interpreted as shell syntax rather than as literal `ldm` arguments. Filtering flags only by the `--` prefix does not make them safe. An argument can begin with `--` and still contain shell syntax. The vulnerable command is used both when LDM is already installed and after the installer silently installs LDM, providing two reachable execution paths. ### Attack Path 1. An attacker supplies a crafted installation target or persuades an agent to invoke `wip-install` with attacker-controlled text. 2. `wip-install` copies the raw target and `--`-prefixed arguments fr ...[truncated 883 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Replace command-string execution with an argument-vector API: ```js execFileSync('ldm', ['install', rawTarget, ...validatedFlags], { stdio: 'inherit' }); ``` Additionally: 1. Allowlist the exact supported flags, such as `--dry-run` and `--json`. 2. Reject unknown options instead of forwarding them. 3. Validate targets as either canonical local paths, strict `owner/repository` identifiers, or URLs accepted by a dedicated URL parser. 4. Do not invoke a shell for delegation. 5. Apply the same correction to both delegation branches. 6. Add regression tests using semicolons, command substitutions, backticks, quotes, spaces, redirections, newlines, and chained operators in both targets and flags. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: tools/wip-universal-installer/install.js:370
• Finding: Repository-Controlled Package Metadata Reaches MCP Registration Shell Commands<![CDATA[ ## Vulnerability Details **File Location**: `tools/wip-universal-installer/install.js:370-413` and `tools/wip-universal-installer/install.js:596-603` **Vulnerability Type**: OS command injection through untrusted repository metadata **Risk Level**: High ### Vulnerable Code The tool name is derived from the installed repository's `package.json`: ```js function installSingleTool(toolPath) { const { interfaces, pkg } = detectInterfaces(toolPath); const ifaceNames = Object.keys(interfaces); if (ifaceNames.length === 0) return 0; const toolName = pkg?.name?.replace(/^@\w+\//, '') || basename(toolPath); ``` That value is used to construct shell commands during MCP registration: ```js function registerMCP(repoPath, door, toolName) { const rawName = toolName || door.name || basename(repoPath); const name = rawName.replace(/^@[\w-]+\//, ''); const serverPath = join(repoPath, door.file); // ... if (!ccAlreadyRegistered) { try { try { execSync(`claude mcp remove ${name} --scope user`, { stdio: 'pipe' }); } catch {} const envFlag = existsSync(OC_ROOT) ? ` -e OPENCLAW_HOME="${OC_ROOT}"` : ''; execSync(`claude mcp add --scope user ${name}${envFlag} -- node "${mcpPath}"`, { stdio: 'pipe' }); ``` ### Technical Analysis The universal installer is explicitly designed to process cloned or local third-party repositories. Their `package.json` metadata must therefore be considered untrusted. The code strips an optional npm scope but does not validate the remaining package name against a strict safe grammar before inserting it into shell command strings. `execSync()` then asks a shell to interpret those strings. Shell-significant characters in metadata can consequently alter the command structure. The quoted `mcpPath` is also assembled using string quoting rather than an argument-vector API. A path containing quote characters may break out of the intended quoted argument. The fallback that write ...[truncated 1164 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate MCP registration names against a strict grammar such as: ```js if (!/^[A-Za-z0-9._-]+$/.test(name)) { throw new Error('Invalid MCP server name'); } ``` 2. Replace shell strings with argument-vector execution: ```js execFileSync('claude', ['mcp', 'remove', name, '--scope', 'user'], { stdio: 'pipe' }); const addArgs = ['mcp', 'add', '--scope', 'user', name]; if (existsSync(OC_ROOT)) { addArgs.push('-e', `OPENCLAW_HOME=${OC_ROOT}`); } addArgs.push('--', 'node', mcpPath); execFileSync('claude', addArgs, { stdio: 'pipe' }); ``` 3. Validate `door.file` and ensure the resolved MCP path remains inside the expected installed tool directory. 4. Require explicit confirmation before registering third-party MCP servers at user scope. 5. Add malicious package-name and path regression tests. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: tools/wip-license-hook/src/core/scanner.ts:62
• Finding: Dependency Names Are Interpolated Into License-Scanner Shell Commands<![CDATA[ ## Vulnerability Details **File Location**: `tools/wip-license-hook/src/core/scanner.ts:62-98`, `tools/wip-license-hook/src/core/scanner.ts:103-143`, and `tools/wip-license-hook/src/core/scanner.ts:155-182` **Compiled Locations**: `tools/wip-license-hook/dist/core/scanner.js:73`, `tools/wip-license-hook/dist/core/scanner.js:115`, and `tools/wip-license-hook/dist/core/scanner.js:152` **Vulnerability Type**: OS command injection through dependency manifests **Risk Level**: High ### Vulnerable Code npm dependency names are taken from repository-controlled JSON keys and passed to a shell: ```ts const pkg = JSON.parse(readFileSync(pkgPath, "utf-8")); const allDeps = { ...pkg.dependencies, ...pkg.devDependencies }; for (const [name, _version] of Object.entries(allDeps)) { let detectedLicense: LicenseId = "UNKNOWN"; // ... if (detectedLicense === "UNKNOWN" && !offline) { try { const out = execSync( `npm view ${name} license 2>/dev/null`, { encoding: "utf-8", timeout: 10000 } ).trim(); if (out) detectedLicense = normalizeSpdx(out); } catch { /* offline or not found */ } } } ``` Parsed Python dependency names reach another shell command: ```ts const name = trimmed.split(/[=<>!~\[]/)[0].trim(); if (name) names.push(name); // ... const out = execSync( `pip show ${name} 2>/dev/null`, { encoding: "utf-8", timeout: 10000 } ); ``` Cargo dependency names are handled similarly: ```ts const match = line.match(/^(\S+)\s*=/); if (!match) continue; const name = match[1]; // ... const out = execSync( `cargo info ${name} 2>/dev/null`, { encoding: "utf-8", timeout: 10000 } ); ``` ### Technical Analysis The license scanner treats project manifests as data sources but executes shell command strings derived from them. A repository being audited may be untrusted, and its dependency names can be attacker-controlled. JSON property names are not constrained by npm's package-name grammar merely because they ...[truncated 1651 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Eliminate shell command construction and use argument vectors: ```ts execFileSync("npm", ["view", name, "license"], { encoding: "utf-8", timeout: 10000 }); execFileSync("pip", ["show", name], { encoding: "utf-8", timeout: 10000 }); execFileSync("cargo", ["info", name], { encoding: "utf-8", timeout: 10000 }); ``` 2. Validate names using the documented grammar for each package ecosystem before invoking external tools. 3. Reject malformed manifest entries and report them as scan errors. 4. Avoid shell redirection; suppress or capture stderr through child-process options. 5. Rebuild and commit corrected `dist` files after changing the TypeScript source. 6. Add regression tests with quotes, semicolons, substitutions, redirections, whitespace, Unicode edge cases, and newlines in manifest entries. 7. Consider running untrusted-repository scans in a constrained subprocess with a minimal environment and no unnecessary credentials. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: tools/wip-release/core.mjs:241
• Finding: Package Publishing Tokens Are Exposed in Child-Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `tools/wip-release/core.mjs:241-293` and `tools/wip-release/core.mjs:1273-1280` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code The npm token is retrieved from 1Password using a service-account secret stored under the OpenClaw directory: ```js function getNpmToken() { try { return execSync( `OP_SERVICE_ACCOUNT_TOKEN=$(cat ~/.openclaw/secrets/op-sa-token) op item get "npm Token" --vault "Agent Secrets" --fields label=password --reveal 2>/dev/null`, { encoding: 'utf8' } ).trim(); } catch { throw new Error('Could not fetch npm token from 1Password. Check op CLI and SA token.'); } } ``` The retrieved token is placed directly in npm's argument vector: ```js export function publishNpm(repoPath) { const token = getNpmToken(); runNpmPublish([ 'publish', '--access', 'public', `--//registry.npmjs.org/:_authToken=${token}`, ], repoPath); } export function publishNpmWithTag(repoPath, tag) { const token = getNpmToken(); runNpmPublish([ 'publish', '--access', 'public', '--tag', tag, `--//registry.npmjs.org/:_authToken=${token}`, ], repoPath); } ``` GitHub Packages uses the same pattern: ```js export function publishGitHubPackages(repoPath) { const ghToken = execSync('gh auth token', { encoding: 'utf8' }).trim(); execFileSync('npm', [ 'publish', '--registry', 'https://npm.pkg.github.com', `--//npm.pkg.github.com/:_authToken=${ghToken}` ], { cwd: repoPath, stdio: 'inherit' }); } ``` The helper redacts errors but not operating-system process arguments: ```js const res = spawnSync('npm', args, { cwd, encoding: 'utf8', stdio: ['inherit', 'inherit', 'pipe'] }); const safeArgs = args.map( a => a.replace(/_authToken=[^&\s]+/, '_authToken=***') ); ``` ### Technical Analysis Error-message redaction protects only the code-generated error string. It does not rem ...[truncated 1482 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place authentication tokens in command-line arguments. 2. Create a temporary npm configuration file in a private temporary directory with permissions `0600`. 3. Point npm to that configuration using an appropriate environment or configuration mechanism. 4. Delete the file in a `finally` block immediately after publication. 5. Ensure errors and debug logs never include the temporary file's contents. 6. Prefer short-lived, automation-specific, package-scoped publishing credentials. 7. Separate npm and GitHub Packages credentials and grant only the permissions required for the target package. 8. Review process-monitoring and CI logging systems for previously captured command lines, and rotate potentially exposed tokens. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (865)

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The setup instructions direct the agent to fetch and execute `https://bun.sh/install` through `bash` if Bun is missing. Remote software installation is a high-impact host modification capability and is not a direct or obvious requirement of a browser QA skill as described in the manifest.

Context-Inappropriate Capability

Critical

• Confidence: 98% confidence
• Finding: The code can discover installed browsers and import cookies from them for a chosen domain, then inject those cookies into the automation context. Harvesting authentication material from local browser profiles is not an obvious or necessary requirement for release pipelines, license compliance, copyright enforcement, repo visibility guards, identity file protection, manifest reconciliation, or best-practices tooling.

Self-Modification

High

• Category: Rogue Agent

Content

## 1.9.18 (2026-03-14)

Rewrite SKILL.md install flow to use ldm install. Conversational AI-guided pattern matching Memory Crystal.

## 1.9.17 (2026-03-14)

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The code implements only one narrow part of the declared toolkit: a release/deployment pipeline that publishes a private repository to a public GitHub repository and syncs releases. It does not show functionality for license compliance, copyright enforcement, repo visibility protection, identity file protection, manifest reconciliation, or MCP-exposed agent-callable tooling. While excluding ai/ and some local config files is loosely related to publication hygiene, that is not enough to substantiate the broader declared description. Therefore the supplied code chunk materially underdelivers relative to the declared capabilities and represents a narrower purpose than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code does not implement any of the declared DevOps/security/compliance toolkit functions such as release pipelines, license checking, copyright enforcement, repository visibility protection, identity file protection, manifest reconciliation, or best-practice validation. Instead, it is a browser manager for automated web interaction using Chromium via Playwright. This is a materially different primary purpose and introduces undeclared capabilities related to browser control, web navigation, event capture, and session handoff. Therefore the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description promises a broad DevOps and repository-governance toolkit with capabilities like release pipelines, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, and MCP-callable core tools. The supplied code does none of those things. Instead, it implements a shared TypeScript utility module containing a fixed-capacity ring buffer and three buffer instances for log, network, and dialog entries. Its purpose is operational event storage for a browser or server component, likely to support observability or response matching. There is no evidence of pipeline management, compliance checks, repository protection, identity file handling, manifest reconciliation, or MCP tool exposure in this chunk. This is a clear description-behavior mismatch with a materially different primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The supplied code does not implement the declared DevOps/security/compliance toolkit functions. Instead, it is a command-line client for a headless browser service, supporting navigation, DOM inspection, screenshots, cookies, tabs, dialogs, and related browser automation. Its primary behavior is starting/restarting a local server, checking health, and forwarding browser commands over HTTP. None of the declared capabilities—release pipeline, license compliance, copyright enforcement, repo visibility guard, identity file protection, manifest reconciliation, or MCP-exposed DevOps best practices—are evidenced in this code chunk. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill is a DevOps toolkit focused on software development governance and repository/security workflows. The supplied code does not implement or reference release pipelines, license compliance, copyright enforcement, repo visibility protection, identity file protection, manifest reconciliation, or best-practice auditing. Instead, it is a browser command catalog for an MCP-style browsing/automation server. Its primary purpose is materially different: defining browser automation commands and their descriptions, with load-time validation of registry completeness. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad DevOps/security/compliance toolkit with features like release pipelines, license compliance, copyright enforcement, repo visibility guarding, identity protection, manifest reconciliation, and MCP-callable core tools. The supplied code does not implement any of those capabilities. Instead, it is a narrow configuration utility for a browse CLI/server, focused on filesystem path resolution, directory creation, .gitignore maintenance, git metadata lookup, and version-file reading. These are materially different behaviors and constitute undeclared capabilities relative to the stated purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a DevOps/security/compliance toolkit focused on software development workflows and repository governance. The supplied code instead implements credential/session access functionality: it inspects local browser data, invokes macOS Keychain to obtain safe-storage passwords, decrypts Chromium cookies, and returns usable cookies for automation. This is a materially different primary purpose and includes sensitive capabilities not suggested by the description. While the code contains some validation and safety checks, those are implementation details and do not align it with the declared DevOps toolkit purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code chunk does not implement any of the declared DevOps/security-compliance toolkit functions such as release pipeline management, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, or best-practices checks. Instead, it provides a local web API and UI for accessing browser cookies and importing them into Playwright sessions. That is a materially different primary purpose and introduces undeclared capabilities related to browser inspection and cookie handling. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about a DevOps and repository-governance toolkit with MCP-callable tools for software development workflows. The supplied code instead implements a cookie picker interface that interacts with local '/cookie-picker' endpoints to enumerate browsers, list cookie domains, import cookies for chosen domains, and remove them from a session. This is a materially different purpose and introduces undeclared capabilities related to browser cookie handling. There is no evidence in this code chunk of release pipelines, license/copyright enforcement, repo visibility controls, identity file protection, manifest reconciliation, or MCP agent tooling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code does not implement any of the declared DevOps toolkit functions such as release pipeline management, license compliance, copyright enforcement, repo visibility protection, identity file protection, manifest reconciliation, or MCP-exposed best-practice tooling. Its actual purpose is narrow and unrelated: locating a local binary on disk and printing its absolute path. While filesystem access and git-root detection are reasonable implementation details for a binary locator, that locator itself is not represented in the declared description. Therefore the description materially misrepresents this code chunk’s primary behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a DevOps/security/compliance toolkit centered on software development workflows and repository governance. The supplied code instead belongs to a browser automation subsystem and exposes interactive browsing meta-commands. Its primary purpose is controlling browser tabs and page capture/inspection, not release pipelines, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, or best-practices checks. While the code includes some security-oriented path and URL validation, those are supporting details and do not align the implementation with the declared DevOps toolkit purpose. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is centered on DevOps/repository governance capabilities, but this code is for a web-browser interaction/inspection subsystem. None of the named declared functions—release pipeline, license compliance, copyright enforcement, repo visibility guard, identity file protection, or manifest reconciliation—are implemented here. Instead, the code exposes browser automation and data-extraction features via Playwright. It also includes capabilities not implied by the description, such as executing arbitrary JS in page context, reading a local file to execute as page JS, exposing cookies/storage/network data, and even modifying localStorage under the 'storage set' branch, which is a side effect and contradicts the file’s stated 'without side effects' comment. This is a material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This code’s primary purpose is browser automation infrastructure, not DevOps/release/compliance/repository protection tooling. None of the declared functions—release pipeline management, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, or best-practice checks—appear in this chunk. Instead, it starts a local authenticated server, launches Chromium, routes browser commands, exposes browser health/cookie routes, and writes runtime/log state to .gstack files. These are materially different capabilities and resources from the declared description, so this is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The supplied code is not related to DevOps, release pipelines, license compliance, copyright enforcement, repository visibility, identity-file protection, manifest reconciliation, or general software-development governance tooling. Its primary purpose is browser automation/inspection: capturing and parsing accessibility snapshots from a webpage, mapping refs to Playwright locators, optionally scanning for interactive DOM elements, generating annotated screenshots, and diffing snapshots over time. These are materially different capabilities and resources from the declared description, so this is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The code chunk does not implement any of the declared DevOps toolkit functions such as release automation, license compliance, copyright enforcement, repo visibility protection, identity file protection, manifest reconciliation, or MCP-exposed core tools. Instead, it performs a specific SSRF/navigation safety function: validating URLs, restricting schemes to HTTP/S, and denying access to cloud metadata hosts. This is a materially different primary purpose and introduces security/navigation validation capabilities not represented in the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description centers on DevOps/repository governance functions, but the code is a web browsing automation command handler. Its primary purpose is controlling a browser and session state, not release pipelines, compliance, copyright enforcement, repo visibility, identity-file protection, or manifest reconciliation. It also accesses resources and capabilities not suggested by the description, including local filesystem reads for uploads/cookie files, browser cookie extraction/import, and opening a local UI endpoint. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about DevOps/repository governance and compliance tooling, but the supplied code clearly belongs to a browser automation system and its test suite. The tested capabilities center on controlling a browser, inspecting pages, interacting with DOM elements, capturing screenshots/PDFs, handling cookies/headers/storage, and enforcing safe file-path handling for browser-related outputs. None of the declared primary functions—release pipeline, license compliance, copyright enforcement, repo visibility guard, identity file protection, manifest reconciliation, or software-development best practices—are represented in this code chunk. This is therefore a strong description/behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a comprehensive DevOps toolkit with multiple security/compliance and release-management capabilities exposed via MCP. The supplied code chunk instead contains unit tests for configuration-related functions of a 'browse' component. It operates on local filesystem paths, .gitignore contents, git metadata parsing, version hash reading, and server script path resolution. While it does touch repository-related details and local state handling, these are supporting config behaviors for a browse utility, not the declared core toolkit features. Therefore the description materially overstates and misrepresents this code chunk's actual purpose and capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a DevOps-oriented toolkit with release, compliance, repository visibility, identity-file protection, manifest reconciliation, and best-practices functions exposed via MCP. The supplied code does none of that. Instead, it is focused on browser cookie import functionality and its tests: handling Chromium cookie DB schemas, decrypting encrypted cookies, mocking keychain access, and validating browser/profile-related behavior. This is a materially different purpose and introduces security-relevant capabilities around browser cookie handling that are not mentioned in the declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a DevOps-oriented toolkit with governance, compliance, release, visibility, identity-file, and manifest features exposed via MCP. The supplied code chunk does not implement or test any of those capabilities. Instead, it is narrowly focused on testing web routes for a cookie-picker feature, including CORS headers, JSON error responses, HTML route handling, and mocked browser cookie operations. This is a materially different purpose and includes undeclared browser/cookie-management-related capabilities unrelated to the declared DevOps toolkit.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code chunk does not implement any of the declared toolkit capabilities such as release automation, license compliance, copyright enforcement, repo visibility guarding, identity file protection, manifest reconciliation, or MCP-callable core tools. Instead, it is a narrow unit test for locating a local 'browse' binary on disk and checking whether the resolved path exists. That behavior is materially different from the declared purpose and introduces filesystem inspection capability not represented in the description. While this may belong somewhere in a larger repository, this specific chunk is unrelated to the stated primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The supplied code does not implement or expose the broad DevOps/security/compliance toolkit described. Instead, it is narrowly focused test code for a local configuration helper script that reads and writes a config.yaml file in a state directory. There is no evidence in this chunk of release automation, license scanning, copyright enforcement, repository visibility checks, identity file protection, manifest reconciliation, or MCP agent-callable interfaces. This is a materially different primary purpose, so the description does not accurately represent the behavior of the provided code chunk.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/browse/test/commands.test.ts:672

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/scripts/dev-skill.ts:24

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/scripts/skill-check.ts:103

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/test/helpers/eval-store.ts:523

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/test/helpers/touchfiles.ts:165

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/test/hook-scripts.test.ts:12

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/test/skill-e2e.test.ts:163

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/test/skill-routing-e2e.test.ts:72

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: ai/repos/gstack-private/test/touchfiles.test.ts:155

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tools/wip-branch-guard/guard.mjs:180

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tools/wip-license-hook/dist/core/scanner.js:73

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tools/wip-license-hook/src/core/scanner.ts:97

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tools/wip-readme-format/format.mjs:354

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tools/wip-release/core.mjs:227

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tools/wip-universal-installer/install.js:35

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: ai/repos/gstack-private/browse/src/cli.ts:20

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: ai/repos/gstack-private/test/skill-e2e.test.ts:22

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: ai/repos/gstack-private/browse/src/server.ts:33

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: ai/repos/gstack-private/browse/test/cookie-import-browser.test.ts:8