Security audit

asimov-laws

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only optional ethics framework that may make an assistant more cautious, but it does not run code, collect secrets, persist, or take control of the system.

Install this only if you want an assistant to use an Asimov-style ethical lens. Expect more proactive ethical checks around broad harm, privacy, deception, illegal, or manipulation topics; administrators can narrow, disable, or modify the framework if it becomes too intrusive.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · CLAUDE.md (reported line 9)May include surrounding context.
md
## Important Notice This skill is a **reference document only**. It does not automatically modify any system settings, prompts, or configurations. All implementation decisions require explicit administrator action. ## Framework Summary

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · CLAUDE.md (reported line 134)May include surrounding context.
md
## Important Notice This skill is a **reference document only**. It does not automatically modify any system settings, prompts, or configurations. All implementation decisions require explicit administrator action. ## Framework Summary

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · INSTALL.md (reported line 49)May include surrounding context.
md
## Important Notice This skill is a **reference document only**. It does not automatically modify any system settings, prompts, or configurations. All implementation decisions require explicit administrator action. ## Framework Summary

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 46)May include surrounding context.
md
## Important Notice This skill is a **reference document only**. It does not automatically modify any system settings, prompts, or configurations. All implementation decisions require explicit administrator action. ## Framework Summary

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · EXAMPLES.md (reported line 51)May include surrounding context.
md
> - General background research for legitimate purposes > > **I cannot help with:** > - Private communications or personal data without consent > - Information that could enable harassment or stalking > > Could you share the purpose of this research? This will help me provide the most useful and appropriate assistance."

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README says the skill provides guidance "when invoked or when relevant ethical situations arise," but it does not define what counts as a relevant ethical situation or provide specific trigger boundaries. For a markdown file, this is an overly broad activation description that could overlap with many ordinary interactions and make invocation behavior unclear.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The statement says ethical warnings should be triggered when requests or topics may touch ethical risks "even ambiguously," which does not clearly distinguish when the framework should activate versus remain inactive. This broad condition could cause unintended or overly frequent invocation because it lacks limiting context or exclusion examples.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file defines trigger keyword categories including broad terms like "damage," "harm," "lie," and "illegal" without clarifying context, thresholds, or false-positive exclusions. Because these words can appear in ordinary conversation, the trigger design is too vague for reliable activation.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
### Expanded Definition of "Harm" For an AI dialogue agent, "harm" includes but is not limited to: | Category | Examples | |----------|----------|

Static analysis

No suspicious patterns detected.