Guardian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:28 AM UTC
• Version: 1.2.0

Overview

Guardian is a safety-oriented skill, but its own instructions and backup checks can incorrectly approve destructive actions, so it needs careful review before installation.

Install only if you treat Guardian as advisory policy, not a reliable enforcement layer. Do not rely on its backup-verification scripts to approve destructive operations without an independent human check, especially for high-risk deletes, overwrites, database changes, system changes, or external writes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:52

Finding

Unvalidated JIT State Can Bypass Mandatory Human Approval

Content

View full analysis

Remediation

View remediation

verified backup AND cryptographically authenticated human approval No authenticated approval -> HALT ``` 4. Establish one canonical decision matrix and generate all documentation from it to prevent contradictory policy branches. 5. Add tests confirming that text such as “JIT is active” cannot alter the decision unless validated through the trusted runtime authorization channel. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/verify-backup.sh:37

Finding

Unix Backup Verification Treats Any Tracked Git File as Safely Backed Up

Content

View full analysis

/dev/null; then add_check "git-repository" "VERIFIED" "Git repository detected, file tracked" "null" VERDICT="VERIFIED" else add_check "git-repository" "PARTIAL" "Git repository detected, file NOT tracked" "null" fi fi ``` ### Technical Analysis The check proves only that the target path is present in the Git index. It does not prove that the current contents are recoverable. A tracked file may contain uncommitted changes, staged-but-uncommitted changes, or changes not present in any remote or durable backup. This directly conflicts with the documentation, which refers to a clean Git status and backup coverage. Returning `VERIFIED` for a modified tracked file can cause Guardian to approve deletion or overwrite of the only copy of current work. The script also does not establish backup recency or durability. A local Git repository on the same disk is not necessarily a backup against disk loss, and merely being tracked does not guarantee that the current content exists in a commit. ### Attack Path 1. A target file is tracked by Git. 2. The file is modified after its most recent commit, leaving valuable uncommitted content. 3. A destructive operation targeting that file invokes `verify-backup.sh`. 4. `git ls-files --error-unmatch` succeeds because the path is tracked. 5. The script emits `"verdict":"VERIFIED"` without checking the worktree or ...[truncated 740 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/verify-backup.ps1:50

Finding

PowerShell Git Check Marks Untracked Paths as Verified

Content

View full analysis

$null if ($LASTEXITCODE -eq 0) { $tracked = $true } } catch {} if ($tracked) { Add-Check "git-repository" "VERIFIED" "Git repository detected, file tracked" $null $verdict = "VERIFIED" } else { Add-Check "git-repository" "PARTIAL" "Git repository detected, file NOT tracked" $null } } ``` ### Technical Analysis Unlike the Unix script, the PowerShell implementation does not use `git ls-files --error-unmatch`. Standard `git ls-files ` generally exits successfully even when no matching tracked file is returned. The script discards command output and relies solely on `$LASTEXITCODE`, so an untracked target in a Git working tree can be classified as tracked and `VERIFIED`. Even for genuinely tracked files, the implementation does not check whether the current content is committed or clean. Consequently, both untracked files and modified tracked files may be falsely treated as recoverable backups. ### Attack Path 1. An untracked file is created inside an existing Git repository. 2. A destructive operation is proposed for that file. 3. Guardian invokes `verify-backup.ps1`. 4. `git ls-files ` returns no matching output but exits with status zero. 5. The script sets `$tracked = $true` because it checks only `$LASTEXITCODE`. 6. The final verdict becomes `VERIFIED`. 7. Guardian may permit deletion or overwrite, although Git contains no recoverable version of the target. ### Impact Assessment This allows loss of any untracked or uncommitted target under a Git repository and undermines the principal safety decision mad ...[truncated 218 chars]

Remediation

View remediation

$null if ($LASTEXITCODE -eq 0 -and $output) { # Continue with clean-state checks. } ``` 2. Check both unstaged and staged differences for the exact path and reject verification if either exists. 3. Verify that the target is present in `HEAD` and can be reconstructed from a commit. 4. Handle directories by validating every affected child rather than treating the directory name as a single tracked object. 5. Capture Git failures explicitly and return `UNVERIFIED`; do not suppress all exceptions with an empty `catch`. 6. Add Pester tests covering untracked, ignored, modified, staged, newly added, and committed files. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/verify-backup.sh:136

Finding

Spoofable Directory Markers Are Accepted as Verified Backups

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · DECISION-MATRIX.md (reported line 122)May include surrounding context.

text

[2026-05-18T13:47:00Z] GUARDIAN CHECK
  Operation: rm -rf /tmp/old-builds
  Category: HIGH (mass delete)
  Backup: VERIFIED ACTIVE (git + Time Machine <2h)
  Decision: PROCEED

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · DECISION-MATRIX.md (reported line 122)May include surrounding context.

md

### File Destruction
| Operation | Pattern | Examples |
|-----------|---------|----------|
| rm / remove | `rm`, `rmdir`, `Remove-Item`, `del` | `rm -rf /tmp/old`, `Remove-Item *.log` |
| unlink | `unlink()`, `os.remove()` | Python file deletion |
| trash | `trash-cli`, `gio trash` | Move to system trash |
| empty-trash | `rm -rf ~/.Trash`, `Clear-RecycleBin` | Permanent deletion of trashed files |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 10)May include surrounding context.

md

### File Destruction
| Operation | Pattern | Examples |
|-----------|---------|----------|
| rm / remove | `rm`, `rmdir`, `Remove-Item`, `del` | `rm -rf /tmp/old`, `Remove-Item *.log` |
| unlink | `unlink()`, `os.remove()` | Python file deletion |
| trash | `trash-cli`, `gio trash` | Move to system trash |
| empty-trash | `rm -rf ~/.Trash`, `Clear-RecycleBin` | Permanent deletion of trashed files |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 10)May include surrounding context.

md

### File Destruction
| Operation | Pattern | Examples |
|-----------|---------|----------|
| rm / remove | `rm`, `rmdir`, `Remove-Item`, `del` | `rm -rf /tmp/old`, `Remove-Item *.log` |
| unlink | `unlink()`, `os.remove()` | Python file deletion |
| trash | `trash-cli`, `gio trash` | Move to system trash |
| empty-trash | `rm -rf ~/.Trash`, `Clear-RecycleBin` | Permanent deletion of trashed files |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 10)May include surrounding context.

md

### File Destruction
| Operation | Pattern | Examples |
|-----------|---------|----------|
| rm / remove | `rm`, `rmdir`, `Remove-Item`, `del` | `rm -rf /tmp/old`, `Remove-Item *.log` |
| unlink | `unlink()`, `os.remove()` | Python file deletion |
| trash | `trash-cli`, `gio trash` | Move to system trash |
| empty-trash | `rm -rf ~/.Trash`, `Clear-RecycleBin` | Permanent deletion of trashed files |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 10)May include surrounding context.

md

### File Destruction
| Operation | Pattern | Examples |
|-----------|---------|----------|
| rm / remove | `rm`, `rmdir`, `Remove-Item`, `del` | `rm -rf /tmp/old`, `Remove-Item *.log` |
| unlink | `unlink()`, `os.remove()` | Python file deletion |
| trash | `trash-cli`, `gio trash` | Move to system trash |
| empty-trash | `rm -rf ~/.Trash`, `Clear-RecycleBin` | Permanent deletion of trashed files |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 13)May include surrounding context.

md

| rm / remove | `rm`, `rmdir`, `Remove-Item`, `del` | `rm -rf /tmp/old`, `Remove-Item *.log` |
| unlink | `unlink()`, `os.remove()` | Python file deletion |
| trash | `trash-cli`, `gio trash` | Move to system trash |
| empty-trash | `rm -rf ~/.Trash`, `Clear-RecycleBin` | Permanent deletion of trashed files |
| overwrite | Write to existing file without version control | `> file.txt` (clobber) |
| truncate | `truncate -s 0`, `fsutil` | Zero-length file without backup |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 13)May include surrounding context.

md

| rm / remove | `rm`, `rmdir`, `Remove-Item`, `del` | `rm -rf /tmp/old`, `Remove-Item *.log` |
| unlink | `unlink()`, `os.remove()` | Python file deletion |
| trash | `trash-cli`, `gio trash` | Move to system trash |
| empty-trash | `rm -rf ~/.Trash`, `Clear-RecycleBin` | Permanent deletion of trashed files |
| overwrite | Write to existing file without version control | `> file.txt` (clobber) |
| truncate | `truncate -s 0`, `fsutil` | Zero-length file without backup |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 13)May include surrounding context.

md

| rm / remove | `rm`, `rmdir`, `Remove-Item`, `del` | `rm -rf /tmp/old`, `Remove-Item *.log` |
| unlink | `unlink()`, `os.remove()` | Python file deletion |
| trash | `trash-cli`, `gio trash` | Move to system trash |
| empty-trash | `rm -rf ~/.Trash`, `Clear-RecycleBin` | Permanent deletion of trashed files |
| overwrite | Write to existing file without version control | `> file.txt` (clobber) |
| truncate | `truncate -s 0`, `fsutil` | Zero-length file without backup |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 67)May include surrounding context.

md

### Configuration
| Operation | Pattern | Examples |
|-----------|---------|----------|
| .env overwrite | Write to `.env`, `secrets.yaml` | Credential/environment changes |
| config modify | Edit `.ini`, `.toml`, `.json` config | Application settings |
| SSH keys | `ssh-keygen`, `authorized_keys` | Authentication changes |
| API keys | Rotate, revoke, regenerate | Service authentication |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 67)May include surrounding context.

md

### Configuration
| Operation | Pattern | Examples |
|-----------|---------|----------|
| .env overwrite | Write to `.env`, `secrets.yaml` | Credential/environment changes |
| config modify | Edit `.ini`, `.toml`, `.json` config | Application settings |
| SSH keys | `ssh-keygen`, `authorized_keys` | Authentication changes |
| API keys | Rotate, revoke, regenerate | Service authentication |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 86)May include surrounding context.

md

| Operation | Why Ambiguous | Guardian Action |
|-----------|---------------|-----------------|
| `git reset --hard` | Destroys uncommitted work | VERIFY backup |
| `git push --force` | Overwrites remote history | VERIFY backup |
| `docker system prune` | Deletes containers/images | VERIFY backup |
| `npm audit fix` | Modifies dependencies | VERIFY backup |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 87)May include surrounding context.

md

| Operation | Why Ambiguous | Guardian Action |
|-----------|---------------|-----------------|
| `git reset --hard` | Destroys uncommitted work | VERIFY backup |
| `git push --force` | Overwrites remote history | VERIFY backup |
| `docker system prune` | Deletes containers/images | VERIFY backup |
| `npm audit fix` | Modifies dependencies | VERIFY backup |
| Package manager update | System-wide changes | VERIFY backup |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · DECISION-MATRIX.md (reported line 142)May include surrounding context.

md

1. **When in doubt, destructive.** If an operation could be either, treat as destructive.
2. **Chained operations count as one.** `find . -name "*.log" -exec rm {} \;` is mass delete even if `find` itself is read-only.
3. **Destructive intent is irrelevant.** The taxonomy cares about operation effect, not agent intent.
4. **Context matters.** `rm test-file-in-temp` is different from `rm /etc/passwd`. Guardian checks target path.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 98)May include surrounding context.

md

1. **When in doubt, destructive.** If an operation could be either, treat as destructive.
2. **Chained operations count as one.** `find . -name "*.log" -exec rm {} \;` is mass delete even if `find` itself is read-only.
3. **Destructive intent is irrelevant.** The taxonomy cares about operation effect, not agent intent.
4. **Context matters.** `rm test-file-in-temp` is different from `rm /etc/passwd`. Guardian checks target path.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · OPERATION-TAXONOMY.md (reported line 98)May include surrounding context.

md

1. **When in doubt, destructive.** If an operation could be either, treat as destructive.
2. **Chained operations count as one.** `find . -name "*.log" -exec rm {} \;` is mass delete even if `find` itself is read-only.
3. **Destructive intent is irrelevant.** The taxonomy cares about operation effect, not agent intent.
4. **Context matters.** `rm test-file-in-temp` is different from `rm /etc/passwd`. Guardian checks target path.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a mandatory destructive-action safety gate, but the artifact is only documentation and does not itself implement interception, enforcement, or reliable detection. This creates a dangerous false sense of protection: operators or downstream agents may believe destructive operations are guarded when they are not, enabling unsafe execution without the promised controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Conflicting natural-language policy around JIT creates a direct policy-bypass avenue for high-risk destructive operations. Because this skill is intended as a mandatory gatekeeper, any ambiguity that permits interpreting approval as optional materially weakens the core safeguard and can be exploited operationally.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The JIT override wording creates a gradual erosion path for policy: what begins as temporary downgrading can become a standing exception for high-risk destructive actions. In a mandatory safety skill, such normalization is dangerous because it encourages implementers to encode a bypass under operational pressure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The note under the decision matrix says high-risk operations can proceed if backup is verified during a JIT window, contradicting the stated guarantee of mandatory human approval. This semantic contradiction normalizes bypass of the approval control and could be adopted by an agent or operator as justification to execute irreversible actions autonomously.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The decision-matrix sidenote reframes a mandatory approval control as conditionally skippable, which weakens the system's security posture through documentation alone. For a guardrail skill, this is especially dangerous because operators often implement from docs, so permissive wording can become the actual behavior in production.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The policy is internally inconsistent: earlier decision logic says unknown or unverified backup status should halt and escalate, but the escalation table later allows medium-risk no-backup operations to self-approve. In a safety gatekeeper for destructive actions, this contradiction can cause agents or implementers to choose the less restrictive path and perform irreversible changes without verified recovery.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · DECISION-MATRIX.md (reported line 65)May include surrounding context.

md

| Scenario | Approver | Timeout |
|----------|----------|---------|
| CRITICAL + no backup | Human operator required | Infinite (no auto-approve) |
| HIGH + no backup | Human operator required | Infinite |
| CRITICAL + stale backup | Human operator recommended | 5 minutes → auto-deny |
| HIGH + stale backup | Human operator recommended | 5 minutes → auto-deny |

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L021 says 'BEFORE any tool call,' which indicates universal interception of all tool invocations. That conflicts with the manifest description at L004 that Guardian 'does NOT trigger on read-only operations,' meaning the documented behavior both applies to all calls and excludes a class of calls.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

2. IF destructive → ENTER Guardian Protocol
  3. EVALUATE Risk Level via CARS Matrix
  4. EXECUTE Decision Path:
     - LOW: Auto-Approve (Log only)
     - MEDIUM: Fast-Track (Verify Backup → Proceed)
     - HIGH: Hard Block (Verify Backup → Human Approval)
  5. IF JIT Window Active → Override High-Risk prompt (Proceed if Backup Verified)

Static analysis

No suspicious patterns detected.