Security audit

agent-safety

Security checks for vulnerabilities and agentic risk

Overview

This safety skill is not overtly malicious, but it can automatically change agent behavior and keep local logs/traces that may contain sensitive task data.

Install only if you want an agent-level safety/control layer that may intercept tasks and keep local audit, loop, and trace data. Use it in a controlled workspace, narrow the trigger rules, configure retention and log clearing, avoid tracing raw env/stdout/message content, and require explicit registration for new tools before relying on its guard decisions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documents file read/write behavior, persistent logs, SQLite tracing, and state/history files, but does not declare an explicit permission model in the metadata. That mismatch can cause the host or reviewers to underestimate what the skill can access and persist, which weakens informed consent and sandboxing decisions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document states that critical findings should be blocked and require reporting, while the sample implementation only sets `blocked = True` and returns structured data without enforcing reporting or any differentiated handling from high severity. In a security control definition, this mismatch can lead integrators to assume stronger protections than are actually implemented, resulting in unsafe deployments or inconsistent incident handling.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The module persistently stores prompts, loop state, and iteration summaries to local files under a memory directory, which extends beyond transient control-flow logic and can retain sensitive user/task content. In an agent-safety skill, this is more concerning because prompts and results may include security decisions, operational context, or sensitive data that later users or processes could read if filesystem access is not tightly controlled.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The code’s handling of unknown tools is inconsistent and unsafe for a guard component: unknown tools are effectively treated as WRITE and returned with allowed=True, relying only on confirmation flags rather than a hard deny. In an agent safety context, a new or aliased tool with destructive capability could bypass strict classification and be presented as merely confirmable, weakening least-privilege enforcement and increasing the chance of unauthorized execution.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: Several triggers such as 安全检查, 权限控制, 敏感信息过滤, and 性能分析 are broad enough to activate in many ordinary conversations outside a narrowly scoped safety workflow. Over-broad activation can cause the skill to run unexpectedly, leading to unnecessary interception, logging, or policy decisions on unrelated tasks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented event schema explicitly includes potentially sensitive fields such as environment variables, message content, command stdout/stderr, and session summaries, but the API documentation does not warn implementers that these values may contain secrets or personal data. In a hook-based security system, this omission is risky because downstream hook scripts and audit logging are likely to persist or retransmit this data, increasing the chance of credential leakage, privacy exposure, or over-collection.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The matcher is broad enough to activate on many common programming-related words, including generic terms like review, test, build, and bug. In a PreTask hook, this can cause frequent unsolicited interception or warning behavior across unrelated or low-risk tasks, creating policy overreach, alert fatigue, and opportunities for workflow manipulation through excessive hook triggering.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The code review trigger matches broad terms like 'review' and '审查' at PreTask time without anchoring to explicit user intent or context, so ordinary requests can unintentionally load the code-reviewer skill. In an agent-safety system, unintended skill activation expands the active instruction set and can alter routing or behavior in ways the user did not request, creating prompt-scope confusion and increasing attack surface.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The security trigger activates on very generic terms such as 'security', '安全', '漏洞', 'credential', which can appear in many benign discussions and cause automatic loading of the security-auditor skill. Because this repository is itself an agent safety/control layer, over-broad security routing is more dangerous here: an attacker can deliberately inject these words to manipulate which defensive or privileged context is loaded, potentially bypassing expected task scoping or causing denial-of-service through excessive guard activation.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Terms like 'test' and '测试' are common in ordinary development conversation, so this trigger can activate the test-engineer skill even when the user is not requesting testing work. That creates unintended context injection and may change agent behavior, tool choice, or output priorities in ways that degrade reliability and can be abused for prompt steering.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Keywords like '模块', '依赖', and 'design pattern' are broad architectural concepts that frequently occur in normal engineering tasks, so this trigger may over-activate the architecture-critic skill. In a hook-based agent system, such over-triggering widens the active policy surface and can let users or adversaries steer the agent into a different analysis mode than intended.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: Generic documentation terms such as 'documentation' and especially 'comment' can appear in many requests unrelated to documentation review, causing unintended activation of the documentation-checker skill. This is dangerous because it enables easy prompt steering through trivial vocabulary, introducing unnecessary instructions and increasing the risk of conflicting behavior.

Vague Triggers

High

Confidence: 98% confidence
Finding: The explore trigger uses extremely broad conversational phrases such as '看看', '有没有', and '是否', which are ubiquitous in normal user prompts. This makes accidental or adversarial activation highly likely, and because it routes to an 'explore' agent, it can materially change behavior toward reconnaissance-like actions, broadening access patterns and undermining predictable policy enforcement.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The export function serializes and returns all trace rows including the metadata and result fields with no filtering, redaction, access control, or warning. In an agent tracing system, those fields commonly contain prompts, tool outputs, tokens, file contents, or other sensitive operational data, so bulk export can create a straightforward confidentiality leak if exposed to users or downstream systems.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code writes user-supplied prompts and iteration-derived content to persistent local storage without any explicit warning, consent, or privacy control. This can expose confidential task details, secrets, or sensitive security-review content, especially in a safety-oriented skill where users may reasonably expect stricter handling of intercepted or analyzed data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The tracer persists arbitrary metadata and operation results directly to SQLite, which can capture prompts, tool outputs, errors, tokens, file paths, or other sensitive content. In an agent-safety context, centralized logging increases the chance that secrets or private user data are retained locally longer than necessary and later exposed through filesystem access, backups, or debugging workflows.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The hook audit and tracing design explicitly persists command data, environment data, message content, and command output to local storage. Those fields frequently contain secrets, tokens, internal paths, personal data, or proprietary prompts, so broad retention materially increases leakage and compliance risk if logs are accessed, exported, or reused.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The tracing and export workflow collects broad operational metadata and supports JSON/CSV export, which can amplify exposure of sensitive tool results and context beyond the runtime boundary. Exportable telemetry is especially risky because it is easy to copy, share, or ingest into less protected systems.

Credential Access

High

Category: Privilege Escalation
Content: conditions: - field: command operator: regex_match pattern: "echo.*>.*\\.env" - field: command operator: contains pattern: "API_KEY"
Confidence: 77% confidence
Finding: The documented rule warns when writing API_KEY values into .env files instead of blocking or enforcing safer secret handling. Normalizing this workflow can encourage plaintext credential storage, and if the resulting file is mishandled or logged elsewhere in the skill, credentials may be exposed.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/guardrail.py:81

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/output_guard.py:99

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/test_guardrails.py:147

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/injection_patterns.md:9

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:203