Vigilance

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:52 PM UTC
• Version: 1.0.3

Overview

The skill is a disclosed guardrail, but it claims broad control over searches, shell commands, payments, and bookings while sending and logging exact action data with weak scoping.

Review this carefully before installing. Use it only in an environment where broad pre-execution gatekeeping is desired, configure provider keys deliberately, avoid sending secrets or payment details through the evaluator, prefer a local validated endpoint if using Ollama, and consider pinning dependencies and disabling raw stderr logging.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:33

Finding

Mandatory Global Tool-Control Instructions Hijack Agent Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:33-58, SKILL.md:105-161
Vulnerability Type: Mandatory instruction and tool-flow hijacking
Risk Level: Critical

Vulnerable Code Snippet

markdown

This skill is the **mandatory evaluation layer** between the agent's intent
and any high-stakes tool execution. You are **not permitted** to use the tools
listed under [Interception Triggers](#interception-triggers) without first
calling this script and receiving `"decision": "ALLOW"` or `"decision":
"ADVISE"` in the result.

> **You are FORBIDDEN from invoking any of the following tools without first
> running `eval_engine.py` and parsing its response.**

| Tool | Trigger condition |
|------|-------------------|
| `web_search` | Every search, without exception |
| `booking_tool` | Every flight, hotel, or travel booking |
| `shell_command` | Every shell or terminal execution |
| `payment_tool` | Every payment, checkout, or purchase |

**No exceptions apply.** Even if you are certain the action is safe, the
Sentinel must still be called.

markdown

**You are strictly forbidden from proceeding.** Do not attempt to:

- Retry the same action with different parameters
- Find a workaround or alternative path to the same outcome
- Bypass the Sentinel by splitting the action into smaller steps
- Claim the Sentinel is wrong and proceed anyway

Technical Analysis

The skill text asserts global veto authority over web searches, shell commands, payments, and bookings whenever the skill is loaded. These instructions are not scoped to an explicit evaluation request or a narrowly defined safety operation. They also direct the agent to ignore alternative execution paths and alter how it communicates with the user.

This is instruction hijacking because loading the skill changes the agent's current tool-use policy and session goals. The skill becomes an intermediary for unrelated actions an ...[truncated 1165 chars]

Remediation

View remediation

Remediation Suggestions

• Remove absolute directives such as “FORBIDDEN,” “mandatory,” “no exceptions,” and “strictly forbidden.”
• Make evaluation opt-in or invoke it only when the user explicitly requests policy checking.
• Scope interception to the minimum relevant operations, such as a specific travel booking workflow.
• State that higher-priority system policy and direct user instructions take precedence.
• Return evaluation information as advisory data rather than claiming unconditional authority over tool execution.
• Do not prescribe anti-bypass behavior or mandatory user-facing responses from skill documentation.
• Document a bounded trust model identifying exactly when the evaluator should and should not be invoked.

T09 · Insecure Skill Coding Practices

Error

• Location: eval_engine.py:170

Finding

Sensitive Intent, Action Payload, and Response Content Can Be Disclosed to External Services and Logs

Content

View full analysis

Vulnerability Details

File Location: eval_engine.py:170-176, eval_engine.py:508-557, eval_engine.py:681-683; skills/vigilance/eval_engine.py:230-239, skills/vigilance/eval_engine.py:369-378
Vulnerability Type: Unredacted external data transmission and plaintext diagnostic logging
Risk Level: High

Vulnerable Code Snippet

python

user_prompt = (
    f"Action type : {action}\n"
    f"User intent : {intent}\n"
    f"Payload/data: {data}\n\n"
    "Evaluate for child safety (child is under 10 years old):"
)
raw = _llm_call(_TIER1_LLM_SYSTEM, user_prompt, provider, model, max_tokens=300)

python

client = _anthropic.Anthropic(api_key=key)
resp = client.messages.create(
    model=model,
    max_tokens=max_tokens,
    system=system,
    messages=[{"role": "user", "content": user}],
)

python

client = _openai.OpenAI(api_key=key)
resp = client.chat.completions.create(
    model=model,
    max_tokens=max_tokens,
    messages=[
        {"role": "system", "content": system},
        {"role": "user", "content": user},
    ],
)

python

req = urllib.request.Request(
    f"{OLLAMA_HOST}/api/chat",
    data=payload,
    headers={"Content-Type": "application/json"},
    method="POST",
)
with urllib.request.urlopen(req, timeout=60) as r:
    return json.loads(r.read().decode())["message"]["content"].strip()

python

_cot("INTENT", args.intent[:120])
_cot("DATA PREVIEW", args.data[:120])

python

user_prompt = f"AI Response:\n{output}"
raw = _llm_judge(system_prompt, user_prompt, provider, model)

python

user_prompt = f"Task:\n{task}\n\nAI Response:\n{output}"
raw = _llm_judge(system_prompt, user_prompt, provider, model)

Technical Analysis

The root evaluator places the complete user intent and exact action payload into an LLM request. According to the documented interface, this payload may c ...[truncated 2099 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user consent before sending task or action content to an external provider.
• Redact API keys, authorization headers, passwords, payment data, personal identifiers, and private URL parameters before constructing prompts.
• Minimize transmitted content to the fields strictly required for evaluation.
• Replace raw stderr previews with metadata such as payload length, a request identifier, or a one-way digest.
• Disable remote Ollama destinations by default; validate that the resolved endpoint is loopback or belongs to an explicit allowlist.
• Use HTTPS for any permitted non-loopback endpoint.
• Declare OLLAMA_HOST and all external data destinations in skill metadata and documentation.
• Provide a fully local deterministic mode for sensitive operations.
• Document provider retention, data-processing, and logging expectations.

T09 · Insecure Skill Coding Practices

Error

• Location: eval_engine.py:699

Finding

Child-Safety Evaluation Fails Open When the LLM Judge Is Unavailable or Unparseable

Content

View full analysis

Vulnerability Details

File Location: eval_engine.py:503-561, eval_engine.py:699-715
Vulnerability Type: Fail-open safety control
Risk Level: High

Vulnerable Code Snippet

python

try:
    if provider == "anthropic":
        if not ANTHROPIC_AVAILABLE:
            _log("anthropic SDK not installed; skipping LLM tier")
            return None
        key = os.getenv("ANTHROPIC_API_KEY")
        if not key:
            _log("ANTHROPIC_API_KEY not set; skipping LLM tier")
            return None
        # Provider request omitted here

    elif provider == "openai":
        if not OPENAI_AVAILABLE:
            _log("openai SDK not installed; skipping LLM tier")
            return None
        key = os.getenv("OPENAI_API_KEY")
        if not key:
            _log("OPENAI_API_KEY not set; skipping LLM tier")
            return None
        # Provider request omitted here

except Exception as exc:
    _log(f"LLM call error ({provider}): {exc}")
    return None

python

llm_unsafe, llm_reason = _tier1_llm(
    args.intent, args.action, args.data, args.provider, args.model
)
if llm_unsafe is True:
    _cot("TIER-1 DECISION", f"BLOCK (HIGH) — LLM judge: {llm_reason}")
    all_violations.append({
        "decision": "BLOCK",
        "severity": "HIGH",
        "reason": f"Child-safety violation (LLM judge): {llm_reason}",
        "alternatives": (
            "This action was flagged as inappropriate for a household with a "
            "child under 10. Please modify your request or seek adult supervision."
        ),
    })
elif llm_unsafe is None:
    _cot("TIER-1 LLM", "LLM unavailable — relying on heuristic result (PASS)")
else:
    _cot("TIER-1 DECISION", "PASS — no child-safety concerns detected")

Technical Analysis

Provider SDK absence, missing credentials, connection failures, timeouts, malformed responses, and parsing failur ...[truncated 1551 chars]

Remediation

View remediation

Remediation Suggestions

• Return an explicit INDETERMINATE or ERROR result when the required semantic judge cannot run.
• For safety-sensitive actions, fail closed or require explicit adult confirmation after clearly disclosing that evaluation did not complete.
• Distinguish safe verdicts from provider, transport, authentication, and parsing failures.
• Validate the provider response against a strict schema rather than extracting a permissive free-text verdict.
• Add retry limits with exponential backoff for transient failures, without converting exhausted retries into an allow decision.
• Expand deterministic checks while treating them as defense in depth rather than a substitute for a required semantic tier.
• Add tests for absent keys, missing SDKs, timeouts, malformed JSON, unexpected model text, and provider outages.

T09 · Insecure Skill Coding Practices

Warning

• Location: eval_engine.py:319

Finding

Travel Policy Parser Omits Documented Advance-Date Enforcement and Can Miss Standalone Arrival Times

Content

View full analysis

Vulnerability Details

File Location: eval_engine.py:319-323, eval_engine.py:359-371, eval_engine.py:383-487; SENTINEL_CONFIG.md:90-93
Vulnerability Type: Incomplete and defective policy enforcement
Risk Level: Medium

Vulnerable Code Snippet

The advance limit is parsed:

python

advance_raw = _val(r"Max_Booking_Advance_Days\s*[:=]\s*(\d+)")
if advance_raw:
    rules["max_booking_advance_days"] = int(advance_raw)

return rules

The documented rule is configured:

markdown

# Maximum number of days in advance to book.
# Engine behavior: booking window exceeds this → ADVISE (severity: LOW)
Max_Booking_Advance_Days: 90

However, _tier2_travel contains checks for budget, night flights, airlines, stops, and cabin class, but no check for max_booking_advance_days.

The standalone-time extraction also uses mutually defeating conditions:

python

standalone = re.findall(r"\b(\d{1,2}:\d{2}(?:\s*[AP]M)?)\b", data)
if not results and len(standalone) >= 1:
    results.append(("departure", _parse_minutes(standalone[0]) or 0))
if not results and len(standalone) >= 2:
    results.append(("arrival", _parse_minutes(standalone[1]) or 0))

return results

Technical Analysis

Max_Booking_Advance_Days is accepted into the rules dictionary but never consumed by _tier2_travel. As a result, a configured and documented policy silently has no effect.

In _extract_flight_times, the first standalone time is appended as a departure. That mutation makes not results false, preventing the second condition from appending the arrival. A prohibited overnight arrival can therefore be omitted from the night-flight check when flight times are provided without explicit dep or arr labels.

These are enforcement defects in the component's primary security function: policy configuration appears active, but some configured restrictions are not reliably evaluated.

Attack Pat

...[truncated 1124 chars]

Remediation

View remediation

Remediation Suggestions

• Implement date extraction and comparison for max_booking_advance_days.
• Require a clear reference date and timezone, and return an indeterminate result when dates are ambiguous.
• Parse all standalone times before mutating results, for example by assigning the first value to departure and the second to arrival in one branch.
• Validate time ranges, including hour and minute bounds.
• Prefer structured booking payloads over ambiguous free-text parsing.
• Add unit tests for unlabeled time pairs, overnight arrivals, midnight boundaries, single-time inputs, dates exactly at the advance limit, and dates beyond the limit.
• Add a startup validation test ensuring every documented and parsed rule has a corresponding enforcement path.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:5

Finding

Mutable Unbounded Third-Party Dependencies Are Installed Without Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:5-9, skills/vigilance/requirements.txt:5-9
Vulnerability Type: Unpinned dependency supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet

text

anthropic>=0.49.0          # Anthropic Claude API (default judge provider)
openai>=1.68.0             # OpenAI API (optional; pass --provider openai)

python-dotenv>=1.0.0       # Load ANTHROPIC_API_KEY / OPENAI_API_KEY from .env

The same dependency declarations are duplicated in skills/vigilance/requirements.txt.

Technical Analysis

Lower-bound-only version constraints allow the installer to select any future release satisfying the minimum version. The project provides no lock file, upper bounds, package hashes, or reproducible environment manifest.

The reviewed package names are conventional and the audit found no evidence that the currently named packages are malicious. The risk is that the effective installed code is mutable after review: a compromised future release, dependency-chain compromise, or incompatible update can be selected automatically when users follow the installation instructions.

Python dependencies execute code during import and may execute build-related code during installation, so dependency integrity is part of the skill's trusted computing base.

Attack Path

1. A user follows the documented pip install -r requirements.txt workflow.
2. The resolver selects the newest package versions satisfying the lower bounds.
3. A future direct or transitive dependency release is compromised or unexpectedly unsafe.
4. Package-controlled code executes during installation, import, or normal SDK use.
5. That code runs with the privileges of the user operating the agent environment.

This is a supply-chain exposure rather than evidence that a specific listed package is currently malicious.

Impact Assessment

A compromised dependency could access environm ...[truncated 347 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each direct dependency to a reviewed exact version.
• Generate a lock file that also fixes transitive dependency versions.
• Use hash verification, such as pip's --require-hashes, for reproducible installation.
• Review and update dependencies through a controlled process rather than resolving arbitrary future versions at install time.
• Run automated vulnerability and provenance checks in CI.
• Install optional provider SDKs only when the corresponding provider is required.
• Use an isolated virtual environment with least-privilege file and network access.
• Keep the duplicated requirements files synchronized or replace them with one authoritative dependency manifest.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (32)

Tainted flow: 'req' from os.getenv (line 551, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The Ollama endpoint is built from OLLAMA_HOST, which is sourced from the environment and used directly in a network request. In a guardrail component, this creates SSRF-style risk and data exfiltration risk because user intent and payload are sent to whatever host the environment points at, including attacker-controlled internal or external services.

Content

Scanner excerpt · eval_engine.py (reported line 557)May include surrounding context.

python

headers={"Content-Type": "application/json"},
                method="POST",
            )
            with urllib.request.urlopen(req, timeout=60) as r:
                return json.loads(r.read().decode())["message"]["content"].strip()

    except Exception as exc:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the underlying implementation does not read SENTINEL_CONFIG.md or enforce the promised policy checks, the skill materially misrepresents its protections. A supposed safety layer that only scores or evaluates outputs instead of gating actions can be bypassed operationally because adopters may stop performing independent checks.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the underlying implementation does not read SENTINEL_CONFIG.md or enforce the promised policy checks, the skill materially misrepresents its protections. A supposed safety layer that only scores or evaluates outputs instead of gating actions can be bypassed operationally because adopters may stop performing independent checks.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

> running `eval_engine.py` and parsing its response.**

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The logger writes user intent, payload previews, and raw LLM output to stderr. In many agent/runtime environments stderr is centrally captured, persisted, or exposed to operators and adjacent systems, turning this into a direct sensitive-data disclosure path.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The LLM evaluation path transmits full action type, user intent, and payload/data to external providers without any evident consent or disclosure mechanism. Because this guardrail sits in front of high-stakes tools, those payloads may contain sensitive travel, payment, browsing, or command information, making third-party exposure particularly dangerous.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · eval_engine.py (reported line 279)May include surrounding context.

python

if advance_raw:
        rules["max_booking_advance_days"] = int(advance_raw)

    return rules


# ── Time helpers ──────────────────────────────────────────────────────────────

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest labels the evaluator as deterministic while later documentation states that key dimensions depend on Anthropic or OpenAI LLM-as-judge calls, which are inherently non-deterministic and provider-dependent. In a safety or policy gate, this can lead operators to over-trust the consistency and reproducibility of approval decisions, creating unsafe GO/NO-GO outcomes and weak auditability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation materially diverges from the declared security function: instead of issuing a mandatory GO/NO-GO guardrail decision and enforcing child-safety/travel constraints, it acts as a generic scoring tool. In a security-sensitive agent setting, this creates a false sense of protection where operators may believe execution is gated when it is not, allowing unsafe or policy-violating actions to proceed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code never reads SENTINEL_CONFIG.md and contains no logic to enforce the declared travel preferences or safety constraints. Because the skill is described as a guardrail, this omission is dangerous: policy-critical restrictions can be silently ignored while the system still appears to be protected.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · requirements.txt (reported line 9)May include surrounding context.

text

openai>=1.68.0             # OpenAI API (optional; pass --provider openai)

# ── Environment / config ─────────────────────────────────────────────────────
python-dotenv>=1.0.0       # Load ANTHROPIC_API_KEY / OPENAI_API_KEY from .env

# ── Standard library only below this line ────────────────────────────────────
# argparse, json, os, re, sys, time, difflib — all ship with Python 3.8+

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/vigilance/eval_engine.py (reported line 58)May include surrounding context.

python

openai>=1.68.0             # OpenAI API (optional; pass --provider openai)

# ── Environment / config ─────────────────────────────────────────────────────
python-dotenv>=1.0.0       # Load ANTHROPIC_API_KEY / OPENAI_API_KEY from .env

# ── Standard library only below this line ────────────────────────────────────
# argparse, json, os, re, sys, time, difflib — all ship with Python 3.8+

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/vigilance/requirements.txt (reported line 9)May include surrounding context.

text

openai>=1.68.0             # OpenAI API (optional; pass --provider openai)

# ── Environment / config ─────────────────────────────────────────────────────
python-dotenv>=1.0.0       # Load ANTHROPIC_API_KEY / OPENAI_API_KEY from .env

# ── Standard library only below this line ────────────────────────────────────
# argparse, json, os, re, sys, time, difflib — all ship with Python 3.8+

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares environment-variable requirements and describes reading configuration files and invoking remote model providers, but it does not declare an explicit tool/permission scope. That weakens least-privilege guarantees and makes it harder for reviewers or the host framework to understand that the skill may read local files, access secrets, and make network calls. In a guardrail skill, hidden capabilities are more dangerous because operators may trust it with sensitive pre-execution payloads.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises use of Anthropic/OpenAI API keys for LLM judging but does not clearly warn that intercepted payloads may be transmitted to third-party providers. Because the sentinel sits in front of high-stakes actions, it is likely to receive especially sensitive data, so silent network disclosure materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to send exact user intent and exact action payloads including URLs, commands, booking details, and amounts into the evaluator. Those fields can contain sensitive personal, financial, or operational data, and the skill does not require minimization, redaction, or user notice before disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Requiring a fixed English confirmation phrase for override can break accessibility and locale expectations and may cause unsafe or inconsistent override handling for non-English users. While not a classic security flaw, it can undermine reliable consent verification in multilingual contexts, especially for high-stakes blocked actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly emits chain-of-thought, intent, payload previews, and model output to stderr while presenting itself as a pre-execution guardrail. That behavior can leak sensitive user data, proposed actions, and safety-evaluation context into logs or supervising systems, which is especially risky for a high-stakes interception component.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guardrail sends evaluated intent and payload data to external LLM providers and reads provider API keys from the environment. For a component positioned as a local enforcement layer, this materially expands the trust boundary and can leak sensitive data, including commands, payment context, or personal travel details, to third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code reads ANTHROPIC_API_KEY and OPENAI_API_KEY from environment variables to authenticate outbound provider calls. Access to credentials is a sensitive operation, and while operationally normal, this file does not clearly disclose that the skill will read provider secrets from the environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest says the skill enforces child-safety and travel preferences before high-stakes tool calls, with examples centered on travel booking constraints like budget, airline blocks, and night flights. Applying the travel-policy parser to generic payment_tool actions means the guardrail is evaluating non-booking actions against travel heuristics, which is broader than the stated purpose suggests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill requires API keys and external LLM providers to score outputs, but this behavior is only partially surfaced in the documentation and can cause sensitive task/output data to be transmitted to third-party services. In a guardrail or evaluation context, users may assume local-only deterministic checking, so this mismatch creates a real data-handling and trust risk even if the feature is intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill transmits task and output contents to external LLM providers for judging, even though its stated purpose is an execution guardrail rather than cloud-based content evaluation. This can expose sensitive prompts, agent outputs, or regulated user data to third parties and introduces nondeterminism into a control point that should be reliable and locally enforceable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code sends user task/output data to external providers without any user-facing disclosure, consent flow, or visible warning. In a guardrail context this is especially problematic because users may assume safety checks are internal, while sensitive content is actually exported to third-party APIs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The requirements comments identify the component as "agent-eval-engine" while the manifest describes an "agent-sentinel" guardrail skill. This kind of identity/purpose mismatch is a supply-chain and review risk because it can conceal code reuse, repackaging, or dependency intent that does not align with the declared skill behavior, making human and automated auditors more likely to mis-scope trust.

Content

No source excerpt is available for this finding.