Guardian Audit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:28 AM UTC
• Version: 1.2.0

Overview

This skill is a plausible audit logger, but it overstates its compliance and tamper-evidence guarantees in ways users could rely on incorrectly.

Review before installing if you need compliance-grade evidence. This skill can be useful for local audit notes, but do not treat its reports as verified compliance proof unless you add authenticated approvals, protected append-only storage, real chain verification in reports, restrictive file permissions, and clear documentation of exactly which events are logged.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/export-report.py:23

Finding

Compliance Reports Falsely Claim Successful Chain Verification

Content

View full analysis

end: continue entries.append(entry) except (json.JSONDecodeError, ValueError): continue ``` ```python print() print("## Chain Integrity") print("Verified: PASS (run `verify-chain.py` for detailed check)") ``` ### Technical Analysis The report generator does not recompute entry hashes, validate `previous_hash` links, check sequence continuity, or invoke `verify-chain.py`. Invalid JSON and malformed timestamps are silently discarded rather than causing report generation to fail. Despite performing no integrity verification, every Markdown report unconditionally contains `Verified: PASS`. This creates a false security and compliance assertion. An attacker does not need to preserve the chain: corrupted or selectively malformed records can be omitted from report statistics while the output still claims successful verification. The JSON report format also processes records without integrity verification, although it does not print the same explicit PASS statement. ### Attack Path 1. Obtain write access to an audit log, or supply a crafted log to the report generator. 2. Delete, alter, or inject records without preserving their hash-chain relationships. 3. Optionally make unwanted records invalid JSO ...[truncated 708 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/log-event.py:23

Finding

Audit Events and Approver Identities Are Not Authenticated

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/log-event.py:106

Finding

Concurrent Writers Can Produce Duplicate Sequences and Broken Hash Chains

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verify-chain.py:28

Finding

Chain Verifier Accepts Logs That Violate the Documented Audit Schema

Content

View full analysis

1: if entry.get('sequence') != entry_count: issues.append( f"Line {line_num}: Sequence gap. Expected {entry_count}, got {entry.get('sequence', 'MISSING')}" ) previous_hash = entry.get('entry_hash', 'missing') return entry_count, issues, previous_hash ``` ### Technical Analysis Sequence validation be ...[truncated 1686 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (34)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The HIPAA section states 'All agent activity logged,' which directly contradicts the manifest's safety-decision-only purpose. In a compliance-oriented skill, overstating audit coverage is particularly dangerous because downstream users may rely on these claims for regulatory, forensic, or security monitoring decisions and fail to implement needed supplemental logging.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 90% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · LOG-SCHEMA.md (reported line 35)May include surrounding context.

md

| `ESCALATION_RESOLVED` | Human responded to escalation |
| `MANUAL_APPROVE` | Human manually approved outside Guardian |
| `MANUAL_DENY` | Human manually denied |
| `AGENT_OVERRIDE_ATTEMPT` | Agent tried to override safety (should not happen) |
| `CHAIN_VERIFICATION` | Automated integrity check passed/failed |

## Hash Computation

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · LOG-SCHEMA.md (reported line 35)May include surrounding context.

md

| `ESCALATION_RESOLVED` | Human responded to escalation |
| `MANUAL_APPROVE` | Human manually approved outside Guardian |
| `MANUAL_DENY` | Human manually denied |
| `AGENT_OVERRIDE_ATTEMPT` | Agent tried to override safety (should not happen) |
| `CHAIN_VERIFICATION` | Automated integrity check passed/failed |

## Hash Computation

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · LOG-SCHEMA.md (reported line 70)May include surrounding context.

md

"previous_hash": "a3f7c8d2e1b4a509f6e3d8c7b2a1f4e5d6c3b8a9f0e1d2c3b4a5f6e7d8c9b0a1",
  "event_type": "GUARDIAN_HALT",
  "agent_id": "agent-7f3a",
  "operation": "rm -rf /tmp/old-builds",
  "target": "/tmp/old-builds",
  "category": "HIGH",
  "backup_verdict": "UNVERIFIED",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · LOG-SCHEMA.md (reported line 70)May include surrounding context.

md

| `sequence` | `42` (monotonic, no gaps) |
| `previous_hash` | SHA-256 of previous entry |
| `event_type` | `GUARDIAN_HALT`, `EXECUTED`, `ESCALATION_RESOLVED` |
| `operation` | `rm -rf /tmp/old-builds` |
| `target` | `/tmp/old-builds` |
| `category` | `HIGH` |
| `backup_verdict` | `UNVERIFIED` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

| `sequence` | `42` (monotonic, no gaps) |
| `previous_hash` | SHA-256 of previous entry |
| `event_type` | `GUARDIAN_HALT`, `EXECUTED`, `ESCALATION_RESOLVED` |
| `operation` | `rm -rf /tmp/old-builds` |
| `target` | `/tmp/old-builds` |
| `category` | `HIGH` |
| `backup_verdict` | `UNVERIFIED` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 77)May include surrounding context.

md

| `sequence` | `42` (monotonic, no gaps) |
| `previous_hash` | SHA-256 of previous entry |
| `event_type` | `GUARDIAN_HALT`, `EXECUTED`, `ESCALATION_RESOLVED` |
| `operation` | `rm -rf /tmp/old-builds` |
| `target` | `/tmp/old-builds` |
| `category` | `HIGH` |
| `backup_verdict` | `UNVERIFIED` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

| `sequence` | `42` (monotonic, no gaps) |
| `previous_hash` | SHA-256 of previous entry |
| `event_type` | `GUARDIAN_HALT`, `EXECUTED`, `ESCALATION_RESOLVED` |
| `operation` | `rm -rf /tmp/old-builds` |
| `target` | `/tmp/old-builds` |
| `category` | `HIGH` |
| `backup_verdict` | `UNVERIFIED` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 77)May include surrounding context.

bash

python3 scripts/log-event.py \
  --event-type GUARDIAN_HALT \
  --operation "rm -rf /tmp/old-builds" \
  --target "/tmp/old-builds" \
  --category HIGH \
  --backup-verdict UNVERIFIED \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REPLAY.md (reported line 67)May include surrounding context.

md

python3 scripts/replay.py audit.log --target "/data/production" --before "2026-05-18T14:05:00Z" --window 300

# Output:
# 14:02:31 GUARDIAN_HALT  rm -rf /data/production/old  (backup: UNVERIFIED)
# 14:03:15 ESCALATION_RESOLVED  human APPROVED with note: "Emergency cleanup approved"
# 14:03:16 EXECUTED  rm -rf /data/production/old  outcome: SUCCESS
# 14:04:00 CHAIN_VERIFICATION  integrity: PASS

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REPLAY.md (reported line 69)May include surrounding context.

md

python3 scripts/replay.py audit.log --target "/data/production" --before "2026-05-18T14:05:00Z" --window 300

# Output:
# 14:02:31 GUARDIAN_HALT  rm -rf /data/production/old  (backup: UNVERIFIED)
# 14:03:15 ESCALATION_RESOLVED  human APPROVED with note: "Emergency cleanup approved"
# 14:03:16 EXECUTED  rm -rf /data/production/old  outcome: SUCCESS
# 14:04:00 CHAIN_VERIFICATION  integrity: PASS

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REPLAY.md (reported line 69)May include surrounding context.

Output:

14:02:31 GUARDIAN_HALT rm -rf /data/production/old (backup: UNVERIFIED)

14:03:15 ESCALATION_RESOLVED human APPROVED with note: "Emergency cleanup approved"

14:03:16 EXECUTED rm -rf /data/production/old outcome: SUCCESS

14:04:00 CHAIN_VERIFICATION integrity: PASS

text

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is an audit logger whose purpose is to record Guardian safety decisions into an append-only, hash-chained log and only activate in explicit safety/compliance contexts. The supplied code does something materially different: it is an offline compliance report generator (export-report.py) that opens an existing log file, parses JSON lines, filters by timestamp, counts event categories/decisions, and prints markdown or JSON summaries. It does not append new log entries, does not capture live safety decisions, does not implement tamper-evident hash chaining, and does not verify the chain despite printing a generic 'Verified: PASS' message with a note to run another script for detailed checking. This is a clear description-behavior mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says this skill is an append-only audit logger paired with Guardian, intended to record safety decisions when explicitly triggered by safety/compliance context. The supplied code does not implement logging or capture of safety decisions at all. Instead, it implements a verification utility that inspects an existing log file for chain integrity problems. While verification is related to audit logging, it is a materially different primary purpose and trigger model from the declared logger behavior, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Append-only line-delimited JSON (NDJSON), one entry per line:

json

{"timestamp":"2026-05-19T13:58:45.112Z","sequence":42,"previous_hash":"a3f7...","event_type":"GUARDIAN_CHECK","agent_id":"agent-7f3a","operation":"rm -rf /tmp/old-builds","target":"/tmp/old-builds","category":"MEDIUM","backup_verdict":"VERIFIED","backup_checks":["git-clean"],"decision":"PROCEED","approver":"guardian-auto","agent_reasoning":"Cleaning up old build artifacts","guardian_notes":"CARS Medium risk auto-approved via git-clean verification","outcome":"SUCCESS","entry_hash":"9e2b..."}

Where Logs Live

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · LOG-SCHEMA.md (reported line 70)May include surrounding context.

md

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 77)May include surrounding context.

md

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REPLAY.md (reported line 67)May include surrounding context.

md

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · REPLAY.md (reported line 69)May include surrounding context.

md

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/log-event.py (reported line 7)May include surrounding context.

python

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/log-event.py (reported line 7)May include surrounding context.

python

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/log-event.py (reported line 7)May include surrounding context.

python

Appends tamper-evident entries to the audit log.

Usage:
    python3 log-event.py --event-type GUARDIAN_HALT --operation "rm -rf /tmp/old" \
        --target "/tmp/old" --category HIGH --backup-verdict UNVERIFIED \
        --decision HALT --approver guardian-auto \
        --agent-reasoning "Cleaning up old builds" \

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The compliance table claims 'Every tool call logged' and 'Automatic logging' even though the skill metadata says the audit logger only activates for explicit safety/compliance contexts and does not handle general logging. This mismatch can mislead operators, auditors, or integrators into believing there is comprehensive coverage when important actions may go unlogged, creating a false sense of assurance and potential audit/control gaps.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.