Wip License Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:44 PM UTC
• Version: 1.9.72

Overview

This is a local license tool, but it can create or rewrite legal/license files and README sections across multiple repos, so it should be reviewed before use.

Install only if you want WIP Computer-style license governance. Run audit or --dry-run first, avoid pointing --fix at a broad parent directory, and review any generated LICENSE, CLA.md, .license-guard.json, and README diffs before committing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown lists `--fix`, `--from-standard`, and `readme-license --fix` commands that automatically apply changes, including across all repos and every README. While a dry-run is shown for one command, the description does not explicitly warn that these operations will overwrite or modify repository files and remove duplicate sections, which could affect user data and repository integrity.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The tool generates and enforces CLA.md files even though the manifest describes license-header and LICENSE-file compliance. Creating contributor agreement documents is a separate governance action that can materially change repository policy and exceed user expectations for a license guard.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill's stated purpose is license compliance, but this code also enforces broader README structure and content rules, such as attribution and removal of technical material. That scope expansion can cause unexpected content modification beyond licensing, especially when combined with --fix, and may alter documentation in ways the user did not intend.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This command recursively scans directory trees, infers repositories from package.json or README.md, and can apply README rewrites across multiple repos. In the context of a supposedly scoped compliance tool for 'your own repos,' that broad traversal and multi-repo mutation increases the risk of accidental bulk modification to unrelated projects.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest describes a tool focused on license compliance for repository files: ensuring copyright headers, dual-license blocks, and LICENSE files. This code also generates a Contributor License Agreement document, which is a separate contributor-governance/legal workflow not mentioned in the declared purpose.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

### Can I use this?

**Yes, freely:**
- Use any tool locally or on your own servers
- Modify the code for your own projects
- Include in your internal CI/CD pipelines
- Fork it and send us feedback via PRs (we'd love that)

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest says the skill 'ensures correct copyright headers, dual-license blocks, and LICENSE files across all source files.' However, the implementation only checks for LICENSE, CLA.md, README.md content, and a repo config file; it never scans source files for copyright headers or per-file dual-license blocks. This is a clear semantic mismatch between the advertised coverage and the actual checks performed.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The inline comment states 'CLA.md should exist for repos with contributors,' which implies a conditional requirement. The code immediately below does not check contributor status and always adds an issue when CLA.md is missing. That is an active contradiction between the documented intent and actual behavior.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The help text encourages using `--from-standard` to apply "WIP Computer defaults" automatically and describes it as "no prompts, just works." This is an organization-specific default behavior embedded in natural language, with no opt-in wording beyond the flag itself and no neutral alternative presented in that message.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The code resolves template content from an environment variable and by walking outside the target repository, which expands the trust boundary beyond the repo being audited. In an agent/tooling context, this can cause repository outputs to be influenced by attacker-controlled external files or ambient host state, leading to content injection, policy bypass, or unintended disclosure of local filesystem structure.

Scope Creep

Low

• Category: Excessive Agency

Content

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.