Back to skill

Security audit

agent-constraints

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent guide, but its optional global hook can persistently record Claude session and transcript pointers for later review.

Install this only if you are comfortable with a Claude-focused, Chinese-language constraint-governance skill. Prefer project-local installation unless you really want it across all projects. If you enable the optional SessionEnd hook, set a project-scoped log path, review what it records, periodically delete old entries, and confirm before allowing an agent to read prior transcript paths or auto-memory feedback from unrelated work.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Note
Location
hooks/log-session.sh:10
Finding

Persistent Collection of Cross-Session Transcript and Memory Metadata

Content
View full analysis
&2 exit 0 fi if ! touch "$LOG"; then printf '%s\n' 'agent-constraints: cannot create session log' >&2 exit 0 fi # 每次都收紧,不只在新建时:已存在的日志可能是更宽的权限建的。 if ! chmod 600 "$LOG"; then printf '%s\n' 'agent-constraints: cannot secure session log' >&2 exit 0 fi ``` `hooks/log-session.sh:49-55`: ```python print("\t".join([ field(datetime.datetime.now().isoformat(timespec="seconds")), field(event.get("cwd", "?")), field(event.get("reason", "?")), field(event.get("session_id", "?")), field(event.get("transcript_path", "?")), ])) ``` `hooks/README.md:53-66`: ```markdown 制表符分隔的五列:时间、工作目录、结束原因、session_id、transcript 路径。 **只记指针,不做内容提取。** transcript 的 JSONL 结构未公开,脚本里解析它会在版本变动时 静默失效。复盘时由 agent 去读这些文件更稳,也更聪明。 ## 另一个信号源:auto memory Claude Code 的 auto memory 本来就在记「你给 Claude 的纠正」,存在 `~/.claude/projects//memory/` 下,frontmatter 里 `type: feedback` 的那些文件。 这是**已经存在的、经过消化的**信号,比原始 transcript 好读。复盘时两个都看: - 会话日志 → 哪些会话值得回看,以及总量趋势 - auto memory 的 feedback 文件 → 已经被识别出来的纠正 ``` `SKILL.md:185-191`: ```markdown 约束的触发条件是「第二次犯同一个错」,这是**跨会话**的信号,所以不做实时判断,只做记录 + 定期复盘。记录机制的装法见 `hooks/README.md`。 建议节奏:每周,或每积累 15–20 个会话一次。**不要每个会话都做**——噪声大于信号。 1. **收集**。两个信号源都看: - `~/.claude/constraint-review.log`(SessionEnd hook 的记录)——哪些会话值得回看 - `~/.claude/projects//memory/` 下 `type: feedback` 的文件——auto memory 已经消化过的纠正 ``` ### Technical Analysis The optional `SessionEnd` hook creates a persistent index containing the working directory, session identifier, and transcript path for e ...[truncated 2532 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · LAYER1-ENFORCEMENT.md (reported line 31)May include surrounding context.

pre-commit

.pre-commit-config.yaml + pre-commit install。注意它有两个天然缺口:hook 装在本地 .git/hooks/,克隆仓库的人不跑 install 就等于没有;git commit --no-verify 无条件跳过。所以它是「早点发现」的工具,红线要另外放 CI。

yaml
repos:

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · LAYER1-ENFORCEMENT.md (reported line 68)May include surrounding context.

chmod +x ~/.claude/hooks/log-session.sh

text

2. 在 `~/.claude/settings.json` 里注册。两个要点:**`command` 用绝对路径**(`~` 的展开行为未经验证),
以及**把下面的 `hooks` 键合并进已有的 settings.json,不要整个覆盖**——那个文件里通常还有
你的 `permissions`、`env` 等配置,覆盖掉会一起丢失。已经有 `hooks` 键的话,
只把 `SessionEnd` 数组加进去。

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · hooks/README.md (reported line 16)May include surrounding context.

chmod +x ~/.claude/hooks/log-session.sh

text

2. 在 `~/.claude/settings.json` 里注册。两个要点:**`command` 用绝对路径**(`~` 的展开行为未经验证),
以及**把下面的 `hooks` 键合并进已有的 settings.json,不要整个覆盖**——那个文件里通常还有
你的 `permissions`、`env` 等配置,覆盖掉会一起丢失。已经有 `hooks` 键的话,
只把 `SessionEnd` 数组加进去。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file uses Chinese throughout its headings, instructions, and evidence text, which effectively forces a specific language for users reading or relying on the skill documentation. The policy only permits this when the skill offers language/locale choice or clearly documents a justified regional constraint, neither of which appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file title and the entire document are written in Chinese, and there is no indication that language selection is optional or limited to a justified region-specific context. This can violate language/locale policy because it effectively forces a specific language for users without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill guidance is written as mandatory Chinese-language content, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains user-facing guidance exclusively in Chinese and does not indicate that the language is optional or region-specific. That can violate a language/locale policy when users are not given a choice of language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language content of the README is entirely in Chinese, which effectively imposes a language requirement on users unless they already read that language. The file does not mention that the skill is Chinese-only, provide an alternate language option, or justify a locale-specific restriction.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

bash
# 所有项目生效(推荐,这个技能是通用的)
mkdir -p ~/.claude/skills && cp -r skills/agent-constraints ~/.claude/skills/
bash

Session Persistence

Medium
Category
Rogue Agent
Confidence
74% confidence
Finding

The README recommends installation into ~/.claude/skills/, which creates persistent availability across all projects and future sessions. In the context of a skill that influences agent constraint behavior, global persistence increases blast radius if the skill is later modified incorrectly, becomes stale, or contains harmful guidance, even though the README itself is not overtly malicious.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

bash
# 所有项目生效(推荐,这个技能是通用的)
mkdir -p ~/.claude/skills && cp -r skills/agent-constraints ~/.claude/skills/
bash

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

bash
# 只在当前项目生效
mkdir -p .claude/skills && cp -r skills/agent-constraints .claude/skills/

验证:新开一个会话,输入 /agent-constraints。刚装好的技能不在当前会话的技能索引里,调用会报 Unknown skill,要等索引刷新才出现。

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README says the skill auto-triggers by matching conversation content and gives example phrases such as “agent 老是犯这个错,该怎么办” and “这条规则该放哪”, which are common, high-level utterances that could arise in many unrelated conversations. It does not provide explicit constraints, exclusion conditions, or a closed trigger list to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill's manifest description forces a specific language/locale for users by presenting activation guidance only in Chinese. The policy requires flagging language or locale constraints when the skill does not explicitly offer the user a language choice or document a justified regional scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

All user-facing guidance in the skill content is written in Chinese, and there is no statement that the user may choose another language or that the skill is intentionally region-specific. This constitutes a natural-language policy issue because it imposes a language constraint without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This manifest-style JSON contains multiple natural-language prompts and expected outputs that assume Chinese as the required interaction language. Because there is no documented opt-in, language selection, or justification for a Chinese-only scope, this can violate the policy against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The entire skill documentation is written in Chinese and does not indicate that other languages are supported or that Chinese is a deliberate, justified locale restriction. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

This is the same persistent-hook behavior flagged a second time by duplicate static analysis output. Installing an always-on hook in the agent configuration directory establishes durable session instrumentation that can outlive the original task and may expose behavioral history and transcript pointers across future sessions.

Content

Scanner excerpt · hooks/README.md (reported line 11)May include surrounding context.

  1. 放置脚本(用户级):

    sh
    mkdir -p ~/.claude/hooks
    cp log-session.sh ~/.claude/hooks/
    chmod +x ~/.claude/hooks/log-session.sh
    

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

This is the same persistent-hook behavior flagged a second time by duplicate static analysis output. Installing an always-on hook in the agent configuration directory establishes durable session instrumentation that can outlive the original task and may expose behavioral history and transcript pointers across future sessions.

Content

Scanner excerpt · hooks/README.md (reported line 11)May include surrounding context.

  1. 放置脚本(用户级):

    sh
    mkdir -p ~/.claude/hooks
    cp log-session.sh ~/.claude/hooks/
    chmod +x ~/.claude/hooks/log-session.sh
    

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · hooks/README.md (reported line 75)May include surrounding context.

md
exit 0
fi
# 每次都收紧,不只在新建时:已存在的日志可能是更宽的权限建的。
if ! chmod 600 "$LOG"; then
    printf '%s\n' 'agent-constraints: cannot secure session log' >&2
    exit 0
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · hooks/log-session.sh (reported line 21)May include surrounding context.

sh
exit 0
fi
# 每次都收紧,不只在新建时:已存在的日志可能是更宽的权限建的。
if ! chmod 600 "$LOG"; then
    printf '%s\n' 'agent-constraints: cannot secure session log' >&2
    exit 0
fi

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The template begins with required placeholder text in Chinese, including the one-sentence project description field, which establishes Chinese as the expected language for the skill file. Because there is no indication that language choice is optional or justified by a region-specific purpose, this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.