Exec Guard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:50 AM UTC
• Version: 1.0.0

Overview

This skill tries to protect shell execution, but it also creates broad auto-approval rules for commands, network access, dependency installs, and persisted sudo preferences.

Review before installing. The skill is not a malware payload, but it changes how an agent decides whether to run commands and can remember broad approvals across sessions. Do not use it unless you are comfortable auditing and narrowing its auto-approval rules, especially for sudo, package managers, network downloads, and git push.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:4

Finding

Always-Loaded Skill Overrides Execution Authorization Policy

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4, SKILL.md:22-24, SKILL.md:208-209
Vulnerability Type: Execution-policy and safety-constraint hijacking
Risk Level: High

Vulnerable Code

Translated excerpt from SKILL.md:4:

yaml

alwaysLoad: true

Translated excerpt from SKILL.md:22-24:

text

Always active (`alwaysLoad: true`).

Before every planned `exec` tool call, mentally apply this Skill's classification rules.

Translated excerpt from SKILL.md:208-209:

text

- In `security: full` mode, Exec Guard supplements it as a soft safeguard
  (recommended but not enforced).
- In `security: allowlist` mode, Exec Guard helps expand the allowlist
  (automatically allowing READ-level operations).

Technical Analysis

The Skill is automatically loaded and instructs the Agent to apply its own command-classification rules before every execution. It also explicitly proposes expanding an execution allowlist and acknowledges that its protections are merely advisory in full-security mode.

This design allows Skill-level instructions to influence or weaken the authorization controls that should be enforced by the host platform. A semantic classifier can provide risk information, but it should not replace platform authorization or independently expand an allowlist. Classification errors, incomplete command parsing, shell composition, or misleading task content could consequently result in execution without the approval expected by the user or platform.

Attack Path

1. The Skill loads automatically because alwaysLoad is enabled.
2. An untrusted task or prompt requests a shell command that appears benign under the Skill's semantic rules.
3. The Skill classifies the operation as automatically permissible.
4. In allowlist mode, the Skill directs the Agent to expand or bypass the intended command restrictions; in full mode, the safeguard remains non-enforcing.
5. The ...[truncated 661 chars]

Remediation

View remediation

Remediation Suggestions

• Remove alwaysLoad: true and require users to activate the classifier explicitly.
• Make all classification results advisory; never let the Skill modify or expand platform allowlists.
• Preserve host-enforced approval requirements regardless of the Skill's classification.
• Require command-specific approval for privileged operations, remote writes, dependency installation, and commands with ambiguous side effects.
• Parse complete command chains, substitutions, redirections, pipelines, and invoked interpreters before assigning a risk level.
• State explicitly that platform security policy takes precedence over all remembered preferences and Skill instructions.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:166

Finding

Persistent Storage of Broad Privileged-Command Approvals

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:166-182
Vulnerability Type: Persistent poisoning of execution-authorization state
Risk Level: High

Vulnerable Code

Translated excerpt from SKILL.md:166-182:

text

## User Preference Learning

Remember the user's security preferences:

User: "You do not need to ask me about npm install."
→ Remember: npm install in the project directory → automatically allow

User: "Ask me before all Docker operations."
→ Remember: all Docker commands → confirmation required

User: "Use sudo freely."
→ Remember: sudo commands → automatically allow
  (but still confirm DESTRUCTIVE-level operations)

Record preferences in `memory/` or MEMORY.md so they remain effective
across sessions.

Technical Analysis

The Skill converts broad natural-language statements into durable authorization rules and stores them in cross-session memory. In particular, it gives unrestricted sudo approval as an example of a preference that can be persisted and automatically applied later.

Authorization is security-sensitive state and should not be learned or generalized like an ordinary usability preference. Natural-language permission may be ambiguous, task-specific, socially engineered, or valid only for the current session. Persisting it allows a statement from one context to suppress confirmation in unrelated future contexts.

This is not confirmed operating-system persistence through a cron job or service. Although crontab -e appears at SKILL.md:81, it is only an example of a system-write command that requires confirmation. The confirmed persistence mechanism is the storage of weakened authorization preferences in memory/ or MEMORY.md.

Attack Path

1. An attacker-controlled prompt, document, or task induces the user or Agent to accept a broad statement such as allowing sudo or package installation without confirmation.
2. The Skill interprets that stateme ...[truncated 817 chars]

Remediation

View remediation

Remediation Suggestions

• Never store approval to use sudo, modify system files, access credentials, install software, or perform network writes in long-term memory.
• Scope approvals to one exact command, normalized arguments, target resources, and the current session.
• Require fresh confirmation whenever privilege level, destination, package, version, repository, or impact changes.
• Treat approval text found in files, web content, tool output, or other untrusted material as data rather than user authorization.
• Record only restrictive preferences, such as requiring additional confirmation, if cross-session security preferences are supported.
• Provide users with a visible mechanism to inspect, expire, and revoke saved preferences.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Automatic Approval of Unverified Dependencies and Network Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-65, SKILL.md:98-111, SKILL.md:172-173
Vulnerability Type: Unsafe dependency acquisition and incorrect network-operation classification
Risk Level: Medium

Vulnerable Code

Translated excerpt from SKILL.md:55-65:

bash

# Typical commands
echo "x" > ./file.txt
mkdir -p ./dir
cp src.txt ./dst.txt
mv ./old.txt ./new.txt
git add / git commit / git push
npm install (inside the project directory)
pip install --user
touch / tee (inside the workspace)
sed -i (workspace files)

Translated excerpt from SKILL.md:98-111:

bash

# Typical commands
curl -X POST / PUT / DELETE
wget (download a file)
ssh / scp / rsync (to a remote system)
git clone (new repository)
docker pull
pip install (download from PyPI)

text

- GET requests to known safe domains → automatically allow
- POST/PUT/DELETE → confirmation required
- Safe-domain allowlist: github.com, pypi.org, npmjs.com,
  api.openai.com, and others

Translated excerpt from SKILL.md:172-173:

text

User: "You do not need to ask me about npm install."
→ Remember: npm install in the project directory → automatically allow

Technical Analysis

The policy permits dependency installation and selected network retrieval based primarily on operation type, working directory, or a broad hostname allowlist. It does not require an exact package version, integrity hash, lockfile, package-source verification, lifecycle-script restriction, or review of retrieved content.

Package installation is not equivalent to a workspace-only file write. Package managers can execute install hooks and arbitrary package code. pip install --user modifies user-level import and executable paths outside the workspace. Likewise, git push modifies a remote repository and therefore should not be categorized as a local workspace write.

A trusted hostname alone is insuffi ...[truncated 1487 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit confirmation for all dependency installations, downloads, and remote writes.
• Classify git push as a network write and pip install --user as a user-level system modification.
• Require lockfiles, exact versions, approved registries, and integrity hashes where supported.
• Prefer isolated environments or containers with minimal filesystem and credential access.
• Disable package lifecycle scripts unless they are required and reviewed.
• Validate exact schemes, hostnames, ports, paths, redirects, and resolved destinations instead of trusting broad parent domains.
• Display the package name, version, source, destination, scripts to be executed, and affected environment before seeking approval.
• Do not persist blanket approval for package-manager commands.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

e 内） sed -i（workspace 内文件）

text

**判断要点**：
- 所有写入目标都在 workspace 或 /tmp 内
- 不影响系统文件
- 可恢复（有 git 或可以重新生成）

### Level 2 — WRITE_SYSTEM（系统级写入）⚠️ 需要确认

**定义**：修改 workspace 外的文件或系统配置。

```bash
# 典型命令
sudo apt install
systemctl start/stop/restart
crontab -e
echo "x" >> ~/.bashrc
cp file /etc/...
chmod / chown（系统目录）
docker run / docker-compose up
npm install -g

处理方式：

• 告诉用户你要做什么、为什么
• 等用户确认后执行
• 如果用户之前说过"这类操作随便做" → 记住偏好，下次自动放行

Level 3 — NETWORK（网络操作）⚠️ 需要确认

定义：主动发起网络请求（不是读取本地资源）。

bash

# 典型命令
curl -X POST / PUT / DELETE
wget（下载文件）
ssh / scp / rsync（到远程）
git clone（新仓库）
docker pull
pip install（从 PyPI

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

dd if=... of=...
mkfs / fdisk
> /dev/sda
git reset --hard
git clean -fd
docker system prune
DROP TABLE / DELETE FROM（数据库）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

dd if=... of=...
mkfs / fdisk
> /dev/sda
git reset --hard
git clean -fd
docker system prune
DROP TABLE / DELETE FROM（数据库）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

即使用户说"什么都自动执行"，以下操作**永远需要确认**：

1. `rm -rf /` 或 `rm -rf ~`（或任何删除根目录/home 目录）
2. `dd` 写入块设备
3. `mkfs` 格式化
4. 任何涉及 `sudo` + 删除的组合

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

即使用户说"什么都自动执行"，以下操作**永远需要确认**：

1. `rm -rf /` 或 `rm -rf ~`（或任何删除根目录/home 目录）
2. `dd` 写入块设备
3. `mkfs` 格式化
4. 任何涉及 `sudo` + 删除的组合

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

即使用户说"什么都自动执行"，以下操作**永远需要确认**：

1. `rm -rf /` 或 `rm -rf ~`（或任何删除根目录/home 目录）
2. `dd` 写入块设备
3. `mkfs` 格式化
4. 任何涉及 `sudo` + 删除的组合

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

即使用户说"什么都自动执行"，以下操作**永远需要确认**：

1. `rm -rf /` 或 `rm -rf ~`（或任何删除根目录/home 目录）
2. `dd` 写入块设备
3. `mkfs` 格式化
4. 任何涉及 `sudo` + 删除的组合

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

即使用户说"什么都自动执行"，以下操作**永远需要确认**：

1. `rm -rf /` 或 `rm -rf ~`（或任何删除根目录/home 目录）
2. `dd` 写入块设备
3. `mkfs` 格式化
4. 任何涉及 `sudo` + 删除的组合

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

即使用户说"什么都自动执行",以下操作**永远需要确认**:

1. `rm -rf /` 或 `rm -rf ~`(或任何删除根目录/home 目录)
2. `dd` 写入块设备
3. `mkfs` 格式化
4. 任何涉及 `sudo` + 删除的组合

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description and the entire skill guidance are written in Chinese and present the interaction format in Chinese only, with no indication that the user may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is documented and justified, which it is not here.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

bash

# 典型命令
echo "x" > ./file.txt
mkdir -p ./dir
cp src.txt ./dst.txt
mv ./old.txt ./new.txt
git add / git commit / git push

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

bash

# 典型命令
echo "x" > ./file.txt
mkdir -p ./dir
cp src.txt ./dst.txt
mv ./old.txt ./new.txt
git add / git commit / git push

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash

# 典型命令
sudo apt install
systemctl start/stop/restart
crontab -e
echo "x" >> ~/.bashrc

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

# 典型命令
sudo apt install
systemctl start/stop/restart
crontab -e
echo "x" >> ~/.bashrc
cp file /etc/...
chmod / chown（系统目录）

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The skill instructs the agent to remember user preferences such as 'sudo commands can be auto-approved,' which weakens safeguards around privileged execution. In an agent setting, persistent blanket approval for sudo can let later prompts trigger sensitive system changes without meaningful re-consent, especially if the remembered preference is overbroad or manipulated.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

用户："docker 操作都先问我" → 记住：所有 docker 命令 → 需要确认

用户："sudo 随便用" → 记住：sudo 命令 → 自动放行（但 DESTRUCTIVE 级别仍然确认）

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Persisting a preference that 'sudo can be used freely' creates a bypass of the very guardrail this skill is supposed to provide. Because sudo grants broad system control, converting it into an auto-allow category materially increases the chance of unauthorized system modification, persistence, or damage from prompt injection or simple user misunderstanding.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

→ 记住：所有 docker 命令 → 需要确认

用户："sudo 随便用" → 记住：sudo 命令 → 自动放行（但 DESTRUCTIVE 级别仍然确认）

text

偏好记录到 `memory/` 或 MEMORY.md 中，跨 session 生效。

Static analysis

No suspicious patterns detected.