Security audit

AgentGuard by Nano

Security checks for vulnerabilities and agentic risk

Overview

AgentGuard has a coherent security-tool purpose, but its artifacts contain serious implementation and documentation gaps that could expose credentials or bypass approval controls.

Review carefully before installing. Do not use this version for real secrets unless the default password is removed, approvals are authenticated, shell-based 1Password calls are replaced with safe argument-based execution, agent IDs are validated, and webhook/file-permission handling is tightened.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (9)

T09 · Insecure Skill Coding Practices

Error

Location: src/1password.js:43
Finding: Shell Command Injection in 1Password CLI Integration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/1password.js:70
Finding: Command Injection Through tmux Command Construction
Content: View full analysis
/dev/null`); } catch {} throw new Error(`tmux execution error: ${e.message}`); } } ``` ### Technical Analysis When `AGENTGUARD_USE_TMUX=true`, a previously assembled 1Password command is embedded inside a single-quoted `tmux send-keys` shell command. An attacker-controlled apostrophe can terminate that quoting context and inject shell syntax. The configurable socket directory is also interpolated into several shell strings. In addition, sending commands through an interactive pane can leave command text and secret-bearing output in tmux history until cleanup succeeds. Error paths or process interruption may prevent complete cleanup. ### Attack Path 1. The tmux integration is enabled through `AGENTGUARD_USE_TMUX=true`. 2. An attacker supplies a value used in a 1Password command, such as an item title, credential value, key, or vault name. 3. The value introduces an apostrophe followed by shell syntax. 4. `execViaTmux()` embeds the resulting command within a single-quoted shell string. 5. The ...[truncated 485 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/cli.js:24
Finding: Predictable Hard-Coded Fallback Vault Password
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/human-gate.js:110
Finding: Unauthenticated Approval of Dangerous Operations
Content: View full analysis
new Date(request.expiresAt)) { request.status = 'expired'; await writeFile(requestFile, JSON.stringify(request, null, 2)); throw new Error('Request has expired'); } if (request.status !== 'pending') { throw new Error(`Request already ${request.status}`); } request.status = 'approved'; request.response = { approved: true, approvedBy, respondedAt: new Date().toISOString() }; await writeFile(requestFile, JSON.stringify(request, null, 2)); return request; } ``` The CLI accepts an arbitrary identity label: ```javascript program .command('approve ') .description('Approve a pending request') .option('-b, --by ', 'Who approved', 'owner') .action(async (requestId, options) => { const guard = await createGuard(); const request = await guard.approveRequest(requestId, options.by); success(`Request approved: ${requestId}`); print(request); }); ``` ### Technical Analysis Approval is authorized solely by knowledge of the request ID. The `approvedBy` value is an unverified user-supplied string and provides no authentication. The implementation does not verify the registered owner, a signed approval token, a biometric assertion, a trusted callback signature, or the identity of the calling process. This conflicts with the documented human-gate security model because the stored transition from `pending` to `approved` is itself the ...[truncated 827 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/vault-op.js:121
Finding: Path Traversal Through Unvalidated Agent Identifiers
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/human-gate.js:41
Finding: Sensitive Approval Records Created Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/feishu-notifier.js:160
Finding: Unrestricted and Potentially Plaintext Webhook Delivery of Approval Details
Content: View full analysis
{ const url = new URL(this.webhookUrl); const client = url.protocol === 'https:' ? https : http; const data = JSON.stringify({ msg_type: 'interactive', card: payload }); const options = { hostname: url.hostname, port: url.port || (url.protocol === 'https:' ? 443 : 80), path: url.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': data.length } }; const req = client.request(options, (res) => { let body = ''; res.on('data', chunk => body += chunk); res.on('end', () => { if (res.statusCode >= 200 && res.statusCode < 300) { resolve({ success: true, body }); } else { reject(new Error(`Webhook failed: ${res.statusCode} ${body}`)); } }); }); req.on('error', reject); req.write(data); req.end(); }); } ``` ### Technical Analysis The webhook URL may use either HTTP or HTTPS, and there is no hostname allowlist. Approval cards include serialized request details, so an HTTP URL exposes those details to network interception. If configuration is attacker-controlled, the process can also be directed to send POST requests to attacker-controlled or internal network endpoints. No request timeout, response-size limit, or destination-address validation is present. ### Attack Path 1. The webhook URL is configured as an HTTP endpoint, attacker-controlled host, or reachable internal service. 2. A dangerous operation creates an approval request. 3. The request details are embedded in the Feishu card payload. 4. `sendWebhook()` POSTs that data to the configured destinati ...[truncated 545 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/audit.js:16
Finding: Audit Logs Are Unkeyed and Use Shared Cross-Agent Chain State
Content: View full analysis
0) { const lastLine = JSON.parse(lines[lines.length - 1]); this.lastHash = lastLine.hash; } } const prevHash = this.lastHash || '0'.repeat(64); const entry = { timestamp: new Date().toISOString(), agentId, operation, details, prevHash }; entry.hash = this.hash(prevHash, entry); await appendFile(logFile, JSON.stringify(entry) + '\n'); this.lastHash = entry.hash; return entry; } } ``` ### Technical Analysis The chain uses plain SHA-256 without a secret key or digital signature. Anyone able to modify a log can alter an entry and recompute all subsequent hashes, so the mechanism does not provide authenticity against an attacker with file access. In addition, `lastHash` is a single object-wide value. Writes for different agents or dates can reuse another file's last hash, creating cross-file links that the per-file verification routine does not expect. This can cause integrity verification failures during normal multi-agent use. The implementation therefore does not substantiate the documentation's claim of cryptographically signed audit l ...[truncated 860 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package-lock.json:24
Finding: Dependency Lockfile Uses a Non-Official Package Registry Mirror
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (74)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documentation claims permission scopes, human approval workflows, and audit trails, but the file itself does not provide a concrete policy model, enforcement architecture, or implementation evidence for those controls. For a credential-handling skill, incomplete or overstated security guarantees materially increase the risk of unauthorized secret use or unreviewed external actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation claims permission scopes, human approval workflows, and audit trails, but the file itself does not provide a concrete policy model, enforcement architecture, or implementation evidence for those controls. For a credential-handling skill, incomplete or overstated security guarantees materially increase the risk of unauthorized secret use or unreviewed external actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation claims permission scopes, human approval workflows, and audit trails, but the file itself does not provide a concrete policy model, enforcement architecture, or implementation evidence for those controls. For a credential-handling skill, incomplete or overstated security guarantees materially increase the risk of unauthorized secret use or unreviewed external actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation claims permission scopes, human approval workflows, and audit trails, but the file itself does not provide a concrete policy model, enforcement architecture, or implementation evidence for those controls. For a credential-handling skill, incomplete or overstated security guarantees materially increase the risk of unauthorized secret use or unreviewed external actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documentation claims permission scopes, human approval workflows, and audit trails, but the file itself does not provide a concrete policy model, enforcement architecture, or implementation evidence for those controls. For a credential-handling skill, incomplete or overstated security guarantees materially increase the risk of unauthorized secret use or unreviewed external actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation claims permission scopes, human approval workflows, and audit trails, but the file itself does not provide a concrete policy model, enforcement architecture, or implementation evidence for those controls. For a credential-handling skill, incomplete or overstated security guarantees materially increase the risk of unauthorized secret use or unreviewed external actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documentation claims permission scopes, human approval workflows, and audit trails, but the file itself does not provide a concrete policy model, enforcement architecture, or implementation evidence for those controls. For a credential-handling skill, incomplete or overstated security guarantees materially increase the risk of unauthorized secret use or unreviewed external actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The documentation claims permission scopes, human approval workflows, and audit trails, but the file itself does not provide a concrete policy model, enforcement architecture, or implementation evidence for those controls. For a credential-handling skill, incomplete or overstated security guarantees materially increase the risk of unauthorized secret use or unreviewed external actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The CLI silently falls back to a hardcoded master password when AGENTGUARD_PASSWORD is unset, which means all local secrets may be encrypted or protected with a publicly guessable value. In a credential-management tool, this defeats the core trust boundary because any user or malware aware of the default can access stored data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The quick-start example shows a secret being passed directly on the command line (agentguard vault store my-agent OPENAI_API_KEY sk-xxx) without any warning or safer alternative. This can expose credentials through shell history, process listings, terminal logging, or copied documentation patterns, which is especially concerning in a skill centered on credential security.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The README states that dangerous operations always require human approval unless policy is set to auto-approve, which creates an explicit bypass for controls protecting high-risk actions such as credential access, external API calls, file writes, and command execution. In a trust middleware skill whose core purpose is enforcing permission boundaries and human oversight, allowing dangerous actions to be auto-approved weakens the security model and could enable fully autonomous sensitive or destructive behavior if misconfigured or abused.
Content: Scanner excerpt · README.md (reported line 157)May include surrounding context.
md
## Dangerous Operations These operations always require human approval (unless policy is `auto-approve`): - `send_message`, `send_email` - `financial_transaction`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises credential storage, approval workflows, and external notifications, and the examples explicitly imply access to environment secrets and network-capable channels, but it declares no explicit tool scope or allowed-tools boundary. In a security-oriented skill, undeclared capabilities are especially risky because users may trust it to enforce boundaries while the runtime permissions remain ambiguous and potentially broader than expected.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README-GITHUB.md (reported line 112)May include surrounding context.
md
## Permission Levels | Level | Auto-approve | Requires Human | |-------|--------------|----------------| | `read` | ✅ Read operations | ❌ | | `write` | ✅ Read/Write | ❌ |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 148)May include surrounding context.
md
## Permission Levels | Level | Auto-approve | Requires Human | |-------|--------------|----------------| | `read` | ✅ Read operations | ❌ | | `write` | ✅ Read/Write | ❌ |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
## Permission Levels | Level | Auto-approve | Requires Human | |-------|--------------|----------------| | `read` | ✅ Read operations | ❌ | | `write` | ✅ Read/Write | ❌ |

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
- Send messages/emails - Financial transactions - Delete data - Modify system config - Access sensitive credentials - External API calls (configurable)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup example instructs users to export a master password in a shell environment variable without warning that environment variables can persist in shell history, process listings, CI logs, or inherited subprocess environments. For a security-focused tool, showing this as the default workflow may cause users to handle real secrets insecurely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation demonstrates retrieving a stored credential and states that the value is directly printed for scripting convenience, but it does not warn that secrets may be exposed in terminal scrollback, logs, screenshots, or piped subprocesses. In a credential-management skill, normalized examples like this can encourage unsafe secret handling patterns and lead users to leak live API keys during routine use.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · TEST-REPORT.md (reported line 198)May include surrounding context.
const apiKey = await guard.getCredential('nano', 'OPENAI_API_KEY');

// 使用 API const response = await fetch('https://api.openai.com/v1/completions', { headers: { 'Authorization': Bearer ${apiKey} } });

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation tells users to store a credential directly on the command line (agentguard vault store my-agent API_KEY xxx), which can expose secrets through shell history, process inspection, terminal logs, or recorded transcripts. Because this is setup guidance for credential management software, readers may copy the pattern into real deployments and inadvertently leak API keys during onboarding.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes AgentGuard as trust middleware focused on credential storage, permission scopes, human approval, and audit trails. This document introduces a broader 'Credit Score System' for agent reputation scoring and ranking, which is a materially different product capability rather than an obvious implementation detail of the stated features.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The report example recommends 'suggestedPermissions: ["admin"]' based on a reputation score, which normalizes privilege elevation from behavioral scoring rather than least-privilege review. In a credential and permission-guarding skill, this is dangerous because operators may treat a soft trust metric as sufficient justification for granting broad administrative access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation explicitly shows bypassing approval for high-scoring agents and auto-adjusting permissions without a strong warning about integrity and abuse risks. In the context of a security middleware skill, guidance that encourages approval bypass and automated elevation can lead adopters to weaken controls around dangerous operations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The dynamic permissions example automatically increases an agent's permission level as its score rises, including promotion to admin at high scores. This creates an unsafe trust-to-privilege pipeline that can be gamed or miscalculated, turning reputation manipulation or scoring errors into direct privilege escalation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation shows approval details, including recipient and subject, being sent to Feishu without any warning that operational data will be disclosed to a third-party messaging platform. In a permission/approval system, these fields can contain sensitive business or personal information, so normal use can unintentionally leak data outside the primary system boundary.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/1password.js:25

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: TEST-REPORT.md:12