Security audit

Env Guard

Security checks for vulnerabilities and agentic risk

Overview

This is a local secret scanner, but it can return unredacted secret lines and may follow symlinks outside the requested scan folder.

Review before installing or using in CI. Prefer CLI use only on trusted workspaces until the raw finding field is removed or fully redacted, and avoid scanning untrusted repositories unless symlink traversal is blocked. Do not serialize or upload programmatic reports from this version because they may contain plaintext secrets.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: src/env-guard.js:98
Finding: Programmatic Scan Results Retain Unredacted Secret-Bearing Source Lines
Content: View full analysis
Remediation: View remediation
this._redact(matchValue) ); const finding = { file: filePath, line: i + 1, type: pat.name, severity: pat.severity, snippet: this._redact(match[0]), context: redactedLine.trim().substring(0, 120) }; ``` For global or overlapping patterns, perform comprehensive redaction across all configured secret patterns before retaining context. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/env-guard.js:63
Finding: Repository-Controlled File Symlinks Can Escape the Requested Scan Root
Content: View full analysis
i.startsWith('.') && ext === i)) continue; this._scanFile(fullPath); } } ``` The resulting path is subsequently opened without canonical-path validation: ```js _scanFile(filePath) { let content; try { content = fs.readFileSync(filePath, 'utf8'); } catch { return; } ``` ### Technical Analysis Directory entries that are not reported as directories are passed directly to `_scanFile()`. The code does not reject `entry.isSymbolicLink()` entries and does not compare the canonical target path against the canonical scan root. Node.js `fs.readFileSync()` follows a file symbolic link. Consequently, a symlink stored inside an attacker-controlled repository can point to a readable file outside the selected workspace. When a victim scans the repository, EnvGuard may read the external target even though the user requested a scan of only the repository. The process remains constrained by the operating-system permissions of the user running EnvGuard. It cannot read files that user cannot read. However, it violates the expected scan-root boundary and can expose matched content through findings. The risk is amplified by the separate unredacted `raw` field vulnerability. ### Attack Path 1. An attacker creates a repository containing a file symlink, such as `config-link`, targeting a likely ...[truncated 1420 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
node src/env-guard.js scan ./my-project

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · README.md (reported line 51)May include surrounding context.
md
**USE AT YOUR OWN RISK.** - The author(s) are NOT liable for any damages, losses, or consequences arising from the use or misuse of this software — including but not limited to financial loss, data loss, security breaches, business interruption, or any indirect/consequential damages. - This software does NOT constitute financial, legal, trading, or professional advice. - Users are solely responsible for evaluating whether this software is suitable for

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
**USE AT YOUR OWN RISK.** - The author(s) are NOT liable for any damages, losses, or consequences arising from the use or misuse of this software — including but not limited to financial loss, data loss, security breaches, business interruption, or any indirect/consequential damages. - This software does NOT constitute financial, legal, trading, or professional advice. - Users are solely responsible for evaluating whether this software is suitable for

Static analysis

No suspicious patterns detected.