Sovereign Project Guardian

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:50 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward project health auditor; it reads repository files to report security and quality gaps, with no hidden persistence, exfiltration, or privilege escalation behavior found.

Install only if you want an agent to inspect the target repository for security and quality issues. Review any suggested npm or npx remediation commands before running them, preferably pin versions and use lock files, and avoid invoking the skill on repositories containing secrets you do not want surfaced in the chat.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: EXAMPLES.md:140

Finding

Unversioned Third-Party Package Installation Creates Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

pg@ jsonwebtoken@ ``` 2. Generate and commit `package-lock.json` only after reviewing the resolved dependency tree and package integrity metadata. 3. For repeatable installation, use the committed lock file: ```bash npm ci ``` 4. In CI, use a clean, isolated runner with least-privilege credentials and restrict unnecessary network and filesystem access. 5. Audit direct and transitive dependencies using appropriate vulnerability and provenance checks before adoption. 6. Review packages for lifecycle scripts. Where operationally compatible, consider disabling scripts during initial inspection: ```bash npm ci --ignore-scripts ``` Required lifecycle scripts should then be reviewed and run explicitly. 7. Execute only locally installed command-line tools. Replace unrestricted `npx` usage with a local package script or: ```bash npx --no-install tsc --init --strict npx --no-install husky init ``` 8. Configure an approved registry, retain npm integrity verification, and consider package allowlisting or lock-file integrity enforcement in CI. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 53)May include surrounding context.

md

- [FAIL] S1: Secrets found in source code
  - `src/db.js:3` contains database password: "dbpass123"
  - `src/routes/users.js:1` contains JWT secret: "mysecret"
- [FAIL] S2: No .gitignore -- .env files would be committed
- [FAIL] S3: package.json uses wildcard versions ("express": "*")
  - No package-lock.json found
- [FAIL] S4: No security middleware (no helmet, no CORS config, no rate limiting)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 120)May include surrounding context.

md

- [FAIL] S1: Secrets found in source code
  - `src/db.js:3` contains database password: "dbpass123"
  - `src/routes/users.js:1` contains JWT secret: "mysecret"
- [FAIL] S2: No .gitignore -- .env files would be committed
- [FAIL] S3: package.json uses wildcard versions ("express": "*")
  - No package-lock.json found
- [FAIL] S4: No security middleware (no helmet, no CORS config, no rate limiting)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 146)May include surrounding context.

md

- [FAIL] S1: Secrets found in source code
  - `src/db.js:3` contains database password: "dbpass123"
  - `src/routes/users.js:1` contains JWT secret: "mysecret"
- [FAIL] S2: No .gitignore -- .env files would be committed
- [FAIL] S3: package.json uses wildcard versions ("express": "*")
  - No package-lock.json found
- [FAIL] S4: No security middleware (no helmet, no CORS config, no rate limiting)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.

md

- [FAIL] S1: Secrets found in source code
  - `src/db.js:3` contains database password: "dbpass123"
  - `src/routes/users.js:1` contains JWT secret: "mysecret"
- [FAIL] S2: No .gitignore -- .env files would be committed
- [FAIL] S3: package.json uses wildcard versions ("express": "*")
  - No package-lock.json found
- [FAIL] S4: No security middleware (no helmet, no CORS config, no rate limiting)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 387)May include surrounding context.

md

- [FAIL] S1: Secrets found in source code
  - `src/db.js:3` contains database password: "dbpass123"
  - `src/routes/users.js:1` contains JWT secret: "mysecret"
- [FAIL] S2: No .gitignore -- .env files would be committed
- [FAIL] S3: package.json uses wildcard versions ("express": "*")
  - No package-lock.json found
- [FAIL] S4: No security middleware (no helmet, no CORS config, no rate limiting)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · EXAMPLES.md (reported line 264)May include surrounding context.

md

Copy `.env.example` to `.env` and fill in values:

    cp .env.example .env

## Usage

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

**Files that must be gitignored:**
- `.env`, `.env.local`, `.env.production`, `.env.staging`, `.env.development`
- `*.pem`, `*.key`, `*.p12`
- `credentials.json`, `service-account*.json`

**Result:**
- PASS: All sensitive file patterns are in `.gitignore`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 421)May include surrounding context.

md

| `SKILL.md` | This file -- complete evaluation methodology |

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 60% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · EXAMPLES.md (reported line 132)May include surrounding context.

text

DATABASE_URL=postgres://user:password@localhost:5432/myapp
JWT_SECRET=change-me-to-a-random-64-char-string
NODE_ENV=development
PORT=3000

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises very broad trigger phrases such as asking for a project's health score or what to fix first, which can easily overlap with normal conversation in unrelated contexts. This increases the chance the skill is invoked unintentionally, causing unexpected repository inspection, noisy outputs, or interference with other higher-priority tasks an agent is performing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.