keelwright

• Outcome: Review
• Latest audit: Sep 1, 2026 · 2:26 PM UTC
• Version: 1.11.0

Overview

Keelwright appears to be a real safety skill, but it needs Review because it combines broad file, shell, network, persistence, and autonomous coding authority with conflicting consent and load-time behavior.

Install only if you want a high-authority autonomous coding safety harness and are comfortable granting project file writes, shell execution, web checks, and persistent local state. Use Copilot or Checkpoint for sensitive projects, keep it in a disposable worktree first, do not allow first-load/bootstrap file creation or downloads unless explicitly requested, and require confirmation before commits, pushes, installs, model downloads, cron jobs, memory writes, or production-affecting actions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (30)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

argv = [part.replace("{skill}", skill_str).replace("{python}", sys.executable)
                for part in argv_template]
        try:
            r = subprocess.run(
                argv, shell=False, capture_output=True, text=True, timeout=30,
                encoding="utf-8", errors="replace",
                cwd=str(skill_dir))

• Confidence: 89% confidence
• Finding: The code intentionally executes Python scripts from the freshly imported skill via subprocess.run. Although shell=False avoids classic shell injection, this still runs attacker-controlled code from an untrusted archive after only self-attested manifest verification, which does not establish trust or provenance. In the context of an importer for portable skill bundles, this is a real code-execution boundary and therefore dangerous if users enable --run-checks on malicious archives.

Tainted flow: 'CAUGHT' from os.environ.get (line 49, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

if not os.path.isdir(d):
        return "fail", f"injection-guard dir missing: {d} (attacks won't be recorded)"
    try:
        with open(CAUGHT, "a", encoding="utf-8") as f:
            pass
        return "pass", f"caught_attacks.jsonl writable: {CAUGHT}"
    except OSError as e:

• Confidence: 82% confidence
• Finding: The file write target is influenced by KEELWRIGHT_HOME from the environment, allowing a caller to redirect the append/open operation to an arbitrary filesystem location under a chosen directory. In contexts where this script runs with elevated privileges or trusted automation, an attacker who can control the environment could cause unintended file creation or modification, including via symlink abuse, and falsely mark the logging layer as healthy.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The skill is presented as a safety engine, but the documented behavior includes materially broader capabilities such as importing/exporting ZIP skills, bootstrap file creation, backups, optional viral prompting logic, and executing example programs. That mismatch can cause operators to grant trust or permissions under a narrower mental model than the skill actually requires, increasing the chance of unsafe execution or installation decisions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill promises that loading is read-only until the user consents, but the documented bootstrap immediately performs a GitHub update check. That creates an unexpected network side effect on load and breaks the user's security boundary, especially in restricted or sensitive environments where passive loading must not trigger outbound traffic.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The file says tracking files are created only after explicit init or direct instruction, but later references claim they are auto-created on first load. Contradictory persistence behavior is dangerous because users may unknowingly allow durable state creation, which can store sensitive context and change future agent behavior.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This code implements a real authentication flow using a hardcoded credential and returns success based solely on direct password comparison. In the context of a security/auditing skill, shipping runnable auth code unrelated to the core purpose is dangerous because users may copy or deploy it, inheriting insecure authentication behavior and embedded secrets.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The comment presents the hardcoded secret as a detector test or warning, but the file still contains an actual embedded credential. That mismatch can normalize insecure code, mislead reviewers into thinking the risk is already handled, and increase the chance that the secret is copied into real deployments or overlooked during review.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill defines a mandatory verdict taxonomy that includes `CANNOT`, then later instructs analysts to record `CANNOT-RUN` when browser tooling is unavailable. This inconsistency can break downstream automation, cause parsers or gates to mis-handle failed checks, and create a path where an unavailable visual test is not cleanly represented or enforced.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The load-time operator notice states that the companion plugin auto-applies protection to every subagent and kanban worker, while other sections explicitly say subagents do not inherit the skill and require either explicit context propagation or plugin installation. This mismatch can cause operators to overtrust coverage that may not actually exist in their runtime, weakening defenses around spawned agents and workers.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file tells the operator that the main agent is protected against web prompt-injection before later admitting protection may be DEGRADED or UNPROTECTED until verification runs and the operator consents to full setup. That creates a false sense of security at exactly the point when an operator decides whether to allow web access.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module docstring explicitly says the tool 'does NOT replace a full audit' and names checks such as zip-slip and manifest integrity, but the implementation still presents itself as an 'audit' enforcer and omits several critical validations. In the context of a security skill meant to vet third-party skill ZIPs before installation, this mismatch can create false assurance and lead operators or agents to install malicious archives that bypass unimplemented checks.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The success message states 'no obvious supply-chain issues found,' which overstates what the script actually verifies and may be interpreted as a meaningful security clearance. Because this skill is specifically marketed as a safety enforcer for autonomous coding workflows, that green result can directly influence trust decisions and increase the chance that unsafe third-party content is approved.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file adds viral/promotional behavior to a security-oriented skill, creating a supply-chain trust and scope-creep issue. Even though it is opt-in, rate-limited, and only prints a message, it introduces non-security engagement logic that can normalize telemetry- or event-driven prompting inside a tool users expect to be strictly defensive.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The hardcoded promotional prompt and sharing links implement engagement functionality unrelated to the stated auditing purpose of the skill. In a security tool context, this is risky because it mixes trust-sensitive defensive workflows with marketing behavior, which can erode operator confidence and create pressure to expand from passive prompting into more invasive actions later.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The prompt explicitly authorizes autonomous installation of missing tools and fully unattended execution. Even though installation is gated by a flag later in the document, this template is designed to drive host-side changes and package installation from within a safety-analysis workflow, which increases supply-chain and system-modification risk if copied into a capable agent environment.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This section instructs the agent to verify external facts using web/network sources such as curl or registry lookups. That expands the skill from local QA guidance into network-enabled behavior, which can leak metadata, create nondeterministic results, and exceed the expected scope of an offline safety skill if the execution environment permits outbound access.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The prompt hardcodes execution of a local script from a specific absolute path and requires the agent to run it autonomously. This couples the skill to a host-specific environment and instructs code execution on the user's machine, which is risky for a prompt artifact because it can trigger unintended local actions, fail unpredictably, or be repointed to a malicious script if that path is compromised.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented schema explicitly stores `model_provider` and free-form `notes` in a local append-only log, but the guidance does not clearly warn operators that these fields can contain sensitive operational metadata or accidentally copied secrets/PII. In a security tool that records adversarial incidents, this creates a realistic privacy and secondary-secrets exposure risk if the file is shared, committed, or read by other local users/processes.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The file uses auto-activation language for cross-session behavior ('auto-wakes on first load') tied to file-based counters and automatic recreation of missing state files. In an agentic environment, ambiguous or automatic triggers can cause actions to occur without a fresh user decision, increasing the risk of unintended writes, analysis runs, or escalation behavior in sensitive repositories.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that, on first load, the agent auto-creates bootstrap files in the project root so they are 'always present from session 1'. Automatic file creation in a repository without an explicit warning or approval can alter user workspaces, interfere with clean repos, and create a path for persistent behavior that the user did not knowingly authorize.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The file explicitly defines an `Autopilot` mode that allows the agent to proceed from plan to code to test to commit and release without waiting for user approval. In a skill intended for autonomous coding by users who may not be able to review code line by line, this materially increases the risk of unauthorized code changes, unsafe releases, and accidental deployment of flawed or insecure behavior, especially when the trigger is broad and default behavior is permissive.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script prepends a user-supplied directory to sys.path and then imports `web_heuristic_guard` and `breaker`, which executes arbitrary Python from that directory during validation. Because `--skill-dir` is externally controlled and there is no sandbox, trust check, or explicit warning, an attacker can achieve code execution simply by supplying a malicious skill tree.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The opening instructions emphasize autonomous execution, persistence, file writes, and possible tool installation, but do not present a concise up-front warning that the prompt can modify the system and use local resources. For a copy-paste prompt intended for broad use, that omission can cause users to run it without informed consent about host impact.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Release

`git push` (per git-safety: new branch, never main without asking) → CI builds → "✅ Shipped."


--- references\bindings\hermes.md ---

• Confidence: 86% confidence
• Finding: The release guidance suggests autonomous push/ship behavior in some modes, which can produce irreversible repository changes without an explicit checkpoint. In a skill designed for unattended coding, this materially increases the risk of propagating insecure or incorrect code to shared remotes or CI pipelines.

Hidden Instructions

High

• Category: Prompt Injection

Content

!�Q�`�Q�	��wPs�F����XCq$���c[��Mhj4�g�%�\�i���ɵ�+#g=�%��gf�V|������������5ې+�T�	�n�OZ�`	O
��ؾG
Օ8V�����Z�Q��S��̧�Q۬�Z�
�ś�Z
�_�r��ʿ(A����ذ����۫�>���Nʛ�[�C�|�L��
�Z�O>SD i�
̛:�Q�Z-������'

• Confidence: 91% confidence
• Finding: The PNG content includes hidden Unicode/control-style content flagged as hidden instructions, which can conceal text from casual review while remaining machine-interpretable. In an agent skill context, hidden content inside assets is suspicious because it can bypass normal review workflows and may influence tooling that ingests file text or OCR/metadata.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.prompt_injection_instructions

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/ad_hoc_verify_template.py:38

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/verify_web_guard.py:47

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/web-guard.md:138

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.full.md:5476