JEP-Guard Audit

• Outcome: Review
• Latest audit: May 28, 2026 · 8:04 AM UTC
• Version: 1.0.0

Overview

This audit skill appears purpose-built rather than malicious, but it overstates security and compliance guarantees that the code does not actually provide.

Install only for experimentation or internal prototyping. Do not rely on this skill for legal, regulatory, security, or tamper-evident audit evidence until real JWS/signature verification, authentication, deployment hardening, sensitive-data handling guidance, and locked dependency versions are added and reviewed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The demo explicitly injects intentional protocol violations earlier in the script, but the final status message states that all events are strict JEP-04 + JAC-01 compliant. This creates a misleading security/compliance signal that can cause operators, developers, or downstream tooling to trust invalid audit chains and overlook real violations during testing or integration.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: This is a real security vulnerability: the module claims strict/full protocol compliance and its verification routine treats any non-empty `sig` field as sufficient, but it never performs actual JWS signature verification, issuer/key validation, or payload integrity checks. An attacker can forge arbitrary events and receipts by supplying any non-empty signature string, causing unauthenticated judgment records to be accepted as `VALID` or `VALID_WITH_FAULT` if the other structural checks pass.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module-level docstring claims JEP-04 signature verification is implemented, but the actual logic only checks that evt.sig is non-empty. This can cause downstream users to trust forged or unauthenticated events as valid audit records, undermining the integrity guarantees of a security/audit component where authenticity is central.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The build_chain docstring states that the function verifies the tamper-evident chain strictly per JEP-04/JAC-01, but signature validation is only a presence check and not actual verification. In an audit skill, this misleading assurance increases the chance that callers treat unverifiable records as compliant, enabling spoofed events to be accepted into compliance exports and risk decisions.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The skill explicitly ingests developer events and exports regulatory audit reports, which commonly include identifiers, assertions, targets, signatures, and raw audit data. The documentation does not warn about sensitive-data handling, minimization, redaction, retention, or access controls, increasing the risk that operators will collect or expose personal, operational, or security-relevant information through the audit pipeline.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.104.0
uvicorn>=0.24.0
pydantic>=2.5.0

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower bound only, which allows installation of any later version, including versions with breaking changes or newly introduced vulnerable transitive dependency sets. In a security-sensitive audit skill, non-reproducible dependency resolution increases supply-chain risk and makes it harder to guarantee that reviewed and deployed environments match.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.104.0
uvicorn>=0.24.0
pydantic>=2.5.0

• Confidence: 96% confidence
• Finding: Using an unpinned version range for uvicorn permits uncontrolled upgrades during installation, which can pull in vulnerable or behavior-changing releases. This weakens build reproducibility and increases the risk of accidentally deploying a version exposed to known HTTP parsing, logging, or response-handling flaws.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.104.0
uvicorn>=0.24.0
pydantic>=2.5.0

• Confidence: 95% confidence
• Finding: The pydantic requirement is also unpinned, so the build may resolve to different versions over time, including versions with denial-of-service or parsing-related flaws. For an API-facing skill, unpredictable validator behavior can directly affect request handling and input safety.

Known Vulnerable Dependency: fastapi — 3 advisory(ies): CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: The requirements file references fastapi without an upper bound or exact patched version, and the package has known advisories affecting some historical releases. Because the declared constraint can resolve to vulnerable versions depending on install time and environment, this is a real supply-chain exposure unless a separate lockfile guarantees a safe version.

Known Vulnerable Dependency: uvicorn — 4 advisory(ies): CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Uvicorn has multiple known advisories in older versions, including issues related to log injection and HTTP response handling. Since the dependency is not pinned to a known-safe version, installations may select a vulnerable release, which is particularly risky for a network-facing API server component.

Known Vulnerable Dependency: pydantic — 3 advisory(ies): CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Pydantic has had vulnerabilities affecting parsing and regular-expression handling, including denial-of-service conditions. In an API skill that likely validates untrusted input, allowing installation of a vulnerable pydantic version can expose request-processing paths to resource exhaustion or parser abuse.

Static analysis

No suspicious patterns detected.