agent-constraints

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 7:49 AM UTC
• Version: 0.1.5

Overview

This is a disclosed guidance skill for managing agent constraints, with an optional local session-end logging hook that users should install only if they want cross-session review data.

Install this only if you want Chinese-language guidance for governing agent constraints. Treat the optional SessionEnd hook as a persistent local configuration change: review the script first, understand that it logs cwd, session_id, end reason, and transcript path, and install it only if that metadata is acceptable on your machine.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### pre-commit

`.pre-commit-config.yaml` + `pre-commit install`。**注意它有两个天然缺口**：hook 装在本地 `.git/hooks/`，克隆仓库的人不跑 `install` 就等于没有；`git commit --no-verify` 无条件跳过。所以它是「早点发现」的工具，红线要另外放 CI。

```yaml
repos:

• Confidence: 75% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Agent Config Directory Access

High

• Category: Agent Snooping

Content

chmod +x ~/.claude/hooks/log-session.sh
   ```

2. 在 `~/.claude/settings.json` 里注册。两个要点：**`command` 用绝对路径**（`~` 的展开行为未经验证），
   以及**把下面的 `hooks` 键合并进已有的 settings.json，不要整个覆盖**——那个文件里通常还有
   你的 `permissions`、`env` 等配置，覆盖掉会一起丢失。已经有 `hooks` 键的话，
   只把 `SessionEnd` 数组加进去。

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

chmod +x ~/.claude/hooks/log-session.sh
   ```

2. 在 `~/.claude/settings.json` 里注册。两个要点：**`command` 用绝对路径**（`~` 的展开行为未经验证），
   以及**把下面的 `hooks` 键合并进已有的 settings.json，不要整个覆盖**——那个文件里通常还有
   你的 `permissions`、`env` 等配置，覆盖掉会一起丢失。已经有 `hooks` 键的话，
   只把 `SessionEnd` 数组加进去。

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file presents all user-facing instructions and evidence in Chinese, which can impose a language constraint on users without opt-in. Under the policy, forcing a specific language is a natural-language policy concern unless the locale restriction is explicitly justified or optionality is offered.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill document is written only in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file contains user-facing instructional content exclusively in Chinese, with no indication that the skill is region-specific or that users may opt into another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill guidance is written in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy rule, a skill that implicitly forces a specific language without opt-in is a natural-language policy concern.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# 所有项目生效（推荐，这个技能是通用的）
mkdir -p ~/.claude/skills && cp -r skills/agent-constraints ~/.claude/skills/
```

```bash

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 所有项目生效（推荐，这个技能是通用的）
mkdir -p ~/.claude/skills && cp -r skills/agent-constraints ~/.claude/skills/
```

```bash

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# 只在当前项目生效
mkdir -p .claude/skills && cp -r skills/agent-constraints .claude/skills/
```

验证：**新开一个会话**，输入 `/agent-constraints`。刚装好的技能不在当前会话的技能索引里，调用会报 `Unknown skill`，要等索引刷新才出现。

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README says the skill auto-triggers by matching conversation content, but the listed phrases include broad everyday-style requests such as "agent 老是犯这个错，该怎么办" and "这条规则该放哪". It does not define scope boundaries or exclusion cases, so users may invoke the skill unintentionally during general discussion rather than when they specifically want this skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description is entirely in Chinese and defines when the skill should be used, which effectively constrains the skill's operation to a specific language context. The file does not indicate that other languages are supported or that the user can opt into Chinese, so this may violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The natural-language prompts and expected outputs are entirely written in Chinese, which indicates the skill is evaluated and implicitly expected to operate in a specific language. There is no visible indication that users may choose another language or that the locale restriction is intentional and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. 放置脚本（用户级）：

   ```sh
   mkdir -p ~/.claude/hooks
   cp log-session.sh ~/.claude/hooks/
   chmod +x ~/.claude/hooks/log-session.sh
   ```

• Confidence: 74% confidence
• Finding: This duplicate finding describes the same persistent hook registration mechanism: copying an executable into the Claude hooks directory and wiring it into `settings.json` for automatic invocation. In the context of an agent skill about enforcing constraints, that persistence is more security-relevant because the hook becomes part of the agent-control plane and could be abused if modified by an attacker or sourced from an untrusted repository.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. 放置脚本(用户级):

   ```sh
   mkdir -p ~/.claude/hooks
   cp log-session.sh ~/.claude/hooks/
   chmod +x ~/.claude/hooks/log-session.sh
   ```

• Confidence: 74% confidence
• Finding: This duplicate finding describes the same persistent hook registration mechanism: copying an executable into the Claude hooks directory and wiring it into `settings.json` for automatic invocation. In the context of an agent skill about enforcing constraints, that persistence is more security-relevant because the hook becomes part of the agent-control plane and could be abused if modified by an attacker or sourced from an untrusted repository.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

exit 0
fi
# 每次都收紧，不只在新建时：已存在的日志可能是更宽的权限建的。
if ! chmod 600 "$LOG"; then
    printf '%s\n' 'agent-constraints: cannot secure session log' >&2
    exit 0
fi

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

exit 0
fi
# 每次都收紧，不只在新建时：已存在的日志可能是更宽的权限建的。
if ! chmod 600 "$LOG"; then
    printf '%s\n' 'agent-constraints: cannot secure session log' >&2
    exit 0
fi

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: This markdown template describes how to structure an AGENTS.md file but does not specify when the resulting skill should activate, what phrases should invoke it, or any exclusion conditions. For markdown files, missing specificity on trigger scope is in scope for vague-trigger findings because it can lead to unintended invocation behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language guidance in the HTML comment is entirely in Chinese and presents required operational instructions for maintaining the file. This imposes a specific language on users or maintainers without any opt-in, alternative language, or documented regional justification, which matches the language/locale policy violation criterion.

Static analysis

No suspicious patterns detected.