CLI Design Framework

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:55 PM UTC
• Version: 1.0.2

Overview

This is a documentation-only CLI design/review skill whose scanner alerts come from examples and taxonomy text, not from hidden execution, credential access, or unsafe installation behavior.

Installers should treat this as an analytical framework for CLI design and review. It may lead an agent to inspect relevant project files and CLI behavior during a review, but the artifact itself does not request credentials, persistence, network execution, or destructive authority. For reviews of real deployment or agent-runtime CLIs, keep normal approval and sandbox policies in place before running any target commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Credential Access

High

• Category: Privilege Escalation

Content

- **Primary role:** Capability (+ Meta / Control-Plane secondary)
- **Primary user type:** Balanced
- **Primary interaction form:** Batch CLI
- **Statefulness:** Config-Stateful (kubeconfig context, namespace state)
- **Risk profile:** Mixed (reads like `get`/`describe`/`logs` are safe; mutations like `delete`/`apply`/`scale` affect live cluster state)
- **Secondary surfaces:** `-o json`, `-o jsonpath`, `--dry-run=server`, extensive label/field selectors

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

3. Confirm only what cannot be inferred reliably.
   - Ask focused confirmation questions only when the answer could materially change the classification or review.
   - Do not ask the user to restate facts already evident from the CLI or code.

4. Review in two layers.
   - Keep **classification fit** and **execution quality** separate.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

neuron model set <name>
```

The command surface looks tidy. But there is no way to actually run an agent session, no approval model for tool use, no sandbox governance, no attach/resume/fork for live sessions, no event streaming, and no execution lifecycle management.

### What went wrong

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- *Who:* CI pipelines, test harnesses, scripts.
- *What:* Run a prompt headlessly with a declared policy, return a structured result.
- *Contract:* Strong. Input schema is documented; output schema has stable field names; exit codes are meaningful. This is the primary machine surface.
- *Boundary:* `exec` is fire-and-forget — it does not support mid-execution approval. If the policy requires human approval, `exec` either uses auto-approve rules from the policy file or fails. This constraint is deliberate: interactive governance belongs on the primary surface.

**NDJSON event stream (`axon attach --events <session-id>`) — planned for post-v1:**
- *Who:* Monitoring tools, dashboards, agent-orchestration scripts.

• Confidence: 86% confidence
• Finding: The batch surface allows runs to proceed using auto-approve rules from a policy file when human approval would otherwise be required. In a CLI whose purpose is to govern high-side-effect agent execution, permissive or overly broad auto-approve rules can silently authorize dangerous tool use in CI or scripts, removing the human checkpoint that the rest of the design treats as a core safety primitive.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The blueprint explicitly says interactive use should not require a policy file even though the CLI is classified as High Side-Effect and is intended to manage tool sandboxes, approvals, and system access. In this context, allowing interactive sessions to start without a policy-backed baseline can lead to under-constrained agent execution, inconsistent guardrails, and accidental filesystem or network side effects before the operator fully understands the effective permissions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This markdown documents `rollback` and `promote` as commands affecting deployments, including production, but does not present a direct user-facing warning near the command descriptions about their destructive or service-impacting nature. Although later analysis notes missing guardrails, the file itself lacks a concise warning to users that these actions can affect live environments and should be used with care.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`service list --json` uses `last_deploy` (snake_case). `status --json` uses `deployedAt` (camelCase). For a Capability CLI claiming a machine secondary surface, field-name stability and consistency are the baseline contract. Mixed conventions signal that the JSON output was added per-command without a shared schema, which means automation consumers cannot trust field names across commands.

**6c. Destructive operations lack proper risk separation.**
`rollback` has no confirmation, no `--dry-run`, no impact preview. `promote` has only a basic `--yes` bypass with a one-line "are you sure?" prompt that does not describe what will happen. For a Mixed risk profile Capability CLI where `rollback` and `promote` affect production traffic, the risk ladder should be:

- Low-risk (no confirmation): `service list`, `service get`, `env show`, `status`
- Medium-risk (confirm + preview): `deploy` to staging — show what will change, require confirmation

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`service list --json` uses `last_deploy` (snake_case). `status --json` uses `deployedAt` (camelCase). For a Capability CLI claiming a machine secondary surface, field-name stability and consistency are the baseline contract. Mixed conventions signal that the JSON output was added per-command without a shared schema, which means automation consumers cannot trust field names across commands.

**6c. Destructive operations lack proper risk separation.**
`rollback` has no confirmation, no `--dry-run`, no impact preview. `promote` has only a basic `--yes` bypass with a one-line "are you sure?" prompt that does not describe what will happen. For a Mixed risk profile Capability CLI where `rollback` and `promote` affect production traffic, the risk ladder should be:

- Low-risk (no confirmation): `service list`, `service get`, `env show`, `status`
- Medium-risk (confirm + preview): `deploy` to staging — show what will change, require confirmation

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`service list --json` uses `last_deploy` (snake_case). `status --json` uses `deployedAt` (camelCase). For a Capability CLI claiming a machine secondary surface, field-name stability and consistency are the baseline contract. Mixed conventions signal that the JSON output was added per-command without a shared schema, which means automation consumers cannot trust field names across commands.

**6c. Destructive operations lack proper risk separation.**
`rollback` has no confirmation, no `--dry-run`, no impact preview. `promote` has only a basic `--yes` bypass with a one-line "are you sure?" prompt that does not describe what will happen. For a Mixed risk profile Capability CLI where `rollback` and `promote` affect production traffic, the risk ladder should be:

- Low-risk (no confirmation): `service list`, `service get`, `env show`, `status`
- Medium-risk (confirm + preview): `deploy` to staging — show what will change, require confirmation

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The description says to use the skill when designing, reviewing, or resolving uncertainty about a CLI's role or characteristics, which covers a very wide range of common CLI discussions. It does not provide concrete trigger phrases, scope limits, or exclusion conditions to distinguish when this skill should activate versus when a general coding or review skill should be used.

Description-Behavior Mismatch

Low

• Confidence: 77% confidence
• Finding: The manifest says this skill should help design or review CLIs and resolve classification uncertainty, which suggests an analytical/documentation role rather than operational behavior. In this example file, the documented code-path observations explicitly describe deploy/rollback/promote commands calling an HTTP API and polling live status, which exceeds a pure design-analysis behavior if taken as representative skill behavior.

Intent-Code Divergence

Low

• Confidence: 71% confidence
• Finding: The file says the mismatches are 'not execution weaknesses' and are category-level design confusion, yet later sections prescribe specific destructive-operation safeguards, output contracts, and mutation return identities. That is not a direct contradiction in code comments, but it does create an intent-level tension between 'classification review' and normative operational governance recommendations.

Static analysis

No suspicious patterns detected.